Frappe

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-41712 1Frappe 1Frappe Jun 17, 2026 Nov 25, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file pa...Show more Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file parameter.Show less
CVE-2022-3988 1Frappe 1Frappe Jun 17, 2026 Nov 14, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The man...Show more A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cross site scripting. The attack may be launched remotely. The name of the patch is bfab7191543961c6cb77fe267063877c31b616ce. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213560.Show less
CVE-2022-28598 1Frappe 1Erpnext Jul 9, 2026 Aug 22, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2022-23055 1Frappe 1Erpnext Jun 17, 2026 Jun 22, 2022 N/A· v4 N/A· v3 5.5 MEDIUM· v2 In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, i...Show more In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.Show less
CVE-2022-23058 1Frappe 1Erpnext Jun 17, 2026 Jun 22, 2022 N/A· v4 N/A· v3 3.5 LOW· v2 ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.
CVE-2022-23057 1Frappe 1Erpnext Jun 17, 2026 Jun 22, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when edit...Show more In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.Show less
CVE-2022-23056 1Frappe 1Erpnext Jun 17, 2026 Jun 22, 2022 N/A· v4 N/A· v3 3.5 LOW· v2 In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.
CVE-2020-35175 1Frappe 1Frappe Jun 17, 2026 Dec 11, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API.
CVE-2020-27508 1Frappe 1Frappe Jun 17, 2026 Dec 11, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security.
CVE-2020-6145 1Frappe 1Erpnext Jun 17, 2026 Aug 10, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to...Show more An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.Show less
CVE-2019-20521 1Frappe 1Erpnext Jun 17, 2026 Mar 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
CVE-2019-20520 1Frappe 1Erpnext Jun 17, 2026 Mar 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
CVE-2019-20519 1Frappe 1Erpnext Jun 17, 2026 Mar 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.
CVE-2019-20518 1Frappe 1Erpnext Jun 17, 2026 Mar 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.
CVE-2019-20517 1Frappe 1Erpnext Jun 17, 2026 Mar 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
CVE-2019-20516 1Frappe 1Erpnext Jun 17, 2026 Mar 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.
CVE-2019-20515 1Frappe 1Erpnext Jun 17, 2026 Mar 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
CVE-2019-20514 1Frappe 1Erpnext Jun 17, 2026 Mar 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
CVE-2019-20529 1Frappe 1Frappe Jun 17, 2026 Mar 18, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) i...Show more In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) instead of private files.Show less
CVE-2019-20511 1Frappe 1Erpnext Jun 17, 2026 Mar 18, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ERPNext 11.1.47 allows blog?blog_category= Frame Injection.

Previous 1 2 3 4 567 Next