Frappe vulnerabilities
266 CVEs and advisories name Frappe as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-44205Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload
- CVE-2026-41581Frappe Vulnerable to Possible SQL Injection via get_blog_list
- CVE-2026-47739Frappe: Stored XSS in Note
- CVE-2026-46546Frappe LMS: HTML injection in user-controlled metadata
- CVE-2026-42839ERPNext 16.16.0 - Stored XSS in POS cart item rendering
- CVE-2026-42840ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals
- CVE-2026-45081Frappe HR: Permission Bypass in HRMS Leave Details API
- CVE-2026-39405Frappe has Path Transversal via SCORM
- CVE-2026-39352Frappe has an Arbitrary File Read via Path Traversal in render_include
- CVE-2026-44448ERPNext: Unauthorised Document modification due to missing validation
- CVE-2026-44447ERPNext: Possibility of SQL Injection due to missing validation
- CVE-2026-44446ERPNext: Possibility of SQL Injection due to missing validation
- CVE-2026-44445ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module
- CVE-2026-44441ERPNext: Possible SSRF by any authenticated user
- CVE-2026-44440ERPNext: Path Traversal Leading to Sensitive File Exposure
- CVE-2026-44442ERPNext: Unauthorised Document modification due to missing validation
- CVE-2026-41430Press vulnerable to reflected XSS on login redirection
- CVE-2026-41317Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation
- CVE-2026-3837Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters
- CVE-2026-3673Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer
- CVE-2026-41320Frappe HR has possibility of SQL Injection due to improper field sanitization
- CVE-2026-40889Frappe HR has Improper Access Control on Files
- CVE-2026-40888Frappe HR vulnerable to Improper Access Control
- CVE-2026-39415Frappe Learning Management System has Client-Side Manipulation of Quiz Scores
- CVE-2026-39351Frappe allows unrestricted Doctype access via API exploit
- CVE-2026-35614Frappe has a SQL injection in bulk_update
- CVE-2026-34606Stored XSS in Frappe LMS
- CVE-2026-32954ERP has a possibility SQL Injection vulnerability due to missing validation
- CVE-2026-31879Frappe Workspace modification and stored XSS due to improper resource ownership checks
- CVE-2026-31878Frappe: Possible SSRF by any authenticated user