Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,568
- Last 24h
- 587
- Critical, 7 days
- 333
- Known exploited
- 1,779
108,032 results · Clear filters · Feed
-
Medium 5.4
Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call t…
-
Medium 4.3
Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authe…
-
Medium 6.5
Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read person…
-
Medium 6.5
Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the aff…
-
Medium 6.5
Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensi…
-
Medium 6.5
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database quer…
-
Medium 6.5
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and e…
-
Medium 6.5
Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify…
-
Medium 6.5
Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read…
-
Medium 4.3
Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned…
-
Medium 6.5
Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read pro…
-
Medium 6.5
Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate ava…
-
Medium 6.5
Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted …
-
Medium 6.5
Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries a…
-
Medium 6.5
Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauth…
-
Medium 6.5
Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read fin…
-
Medium 4.9
Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL…
-
Medium 4.3
Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send r…
-
Medium 6.5
Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially craft…
-
Medium 6.5
Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their …
-
Medium 4.3
Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated u…
-
Medium 4.3
Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned…
-
Medium 6.5
Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints …
-
Medium 6.5
Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints
Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensit…
-
Medium 6.5
Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financia…
-
Medium 6.5
Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the …
-
Medium 6.5
Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyo…
-
Medium 5.4
Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization
Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and d…
-
Medium 4.3
Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond…
-
Medium 6.5
Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip pe…
-
Medium 6.5
Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial re…
-
Medium 6.5
Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to c…
-
Medium 4.3
Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned…
-
Medium 6.5
Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data …
-
Medium 6.5
Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and e…
-
Medium 5.4
Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters
Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute sc…
-
Medium 5.3
Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity …
-
Medium 4.3
Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification
Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their …
-
Medium 4.3
Frappe before 16.33.0 Broken Authorization via send_sms Endpoint
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions c…
-
Medium 5.4
Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents o…