Vendor
Frappe Technologies
268 known vulnerabilities.
Frappe Technologies at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 6 | 0 |
| Oct 2026 | 112 | 1 |
| Sep 2026 | 7 | 0 |
| Aug 2026 | 25 | 2 |
| Jul 2026 | 11 | 0 |
| Jun 2026 | 26 | 0 |
| May 2026 | 11 | 2 |
| Apr 2026 | 11 | 1 |
| Mar 2026 | 7 | 1 |
| Feb 2026 | 4 | 1 |
| Jan 2026 | 2 | 0 |
| Dec 2025 | 8 | 1 |
| Nov 2025 | 3 | 0 |
| Oct 2025 | 8 | 0 |
| Sep 2025 | 3 | 0 |
| Aug 2025 | 3 | 0 |
| Jul 2025 | 1 | 0 |
| Jun 2025 | 3 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 4 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
268 results · Feed
-
Medium 4.3
Frappe before 16.35.0 Broken Access Control in File List/Report Queries
Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to…
-
Medium 4.3
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including por…
-
Medium 6.5
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary…
-
Medium 6.5
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_bom_items and get_bom_diff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, ca…
-
Medium 4.3
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_linked_payments_for_doc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname val…
-
Medium 4.3
Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve exp…
-
Medium 5.3
Frappe LMS allows unpublished certificate access
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the c…
-
Medium 5.3
Frappe LMS: Quiz result manipulation and cross-user submission forgery
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a…
-
Medium 5.3
Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course …
-
Medium 5.1
Frappe LMS has Stored XSS in Course Meta
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management m…
-
Critical 9.9
Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside th…
-
High 8.8
Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields
Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational ro…
-
Medium 6.5
Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database q…
-
Medium 5.0
Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect
Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP …
-
High 7.7
Frappe Builder before 1.36.1 SSRF via convert_to_webp
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call…
-
Medium 4.3
Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt
Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improv…
-
High 7.1
Frappe before 16.33.0 Blind SQL Injection via get_events
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send …
-
Medium 4.6
Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim…
-
Medium 4.3
Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoin…
-
Medium 5.4
Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or c…
-
Medium 6.5
Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated w…
-
Medium 6.5
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payment…
-
Medium 6.5
ERPNext: Unauthorised access to financial data due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user reque…
-
High 7.7
ERPNext: Unauthorised status modification due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whiteliste…
-
High 7.7CVE-2026-111389 Public exploit
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafte…
-
Medium 5.4
Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types …
-
High 8.7
Frappe: Possibility of SQL injection in reportview
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the applicat…
-
Medium 5.1
Frappe: Open Redirect via Unsanitized OAuth State Param.
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attac…
-
Medium 6.5
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate datab…
-
Medium 4.3
Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JM…
-
High 7.3
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can cra…
-
Medium 6.5
Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their…
-
High 7.3
Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes i…
-
Medium 5.4
Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name tha…
-
Medium 4.3
Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accoun…
-
Medium 4.3
Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints …
-
High 8.8
Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, incl…
-
Medium 6.5
Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify i…
-
Medium 4.3
Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records,…
-
Medium 4.3
Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role…