Veille CVE

Recherche « Frappe Framework »

56 CVE

Critique 0 Élevée 12 Moyenne 41 Faible 3 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Frappe Framework » ✕
  1. CVE-2026-114664 7.1 Élevée

    frappe

    Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.

  2. CVE-2026-111388 5.4 Moyenne

    frappe

    Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.

  3. CVE-2026-66057 5.1 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.

  4. CVE-2026-55823 8.7 Élevée

    frappe

    Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.

  5. CVE-2026-109603 3.3 Faible

    frappe

    Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs.

  6. CVE-2026-109601 6.5 Moyenne

    frappe

    Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.

  7. CVE-2026-109600 5.3 Moyenne

    frappe

    Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.

  8. CVE-2026-109598 4.3 Moyenne

    frappe

    Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company.

  9. CVE-2023-54411 5.9 Moyenne

    frappe

    Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

  10. CVE-2026-82634 6.5 Moyenne

    frappe

    Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table.

  11. CVE-2026-66003 7.1 Élevée

    frappe

    Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType's own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0.

  12. CVE-2026-66002 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0.

  13. CVE-2026-66001 8.5 Élevée

    frappe

    Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf_token in frappe/templates/includes/oauth_confirmation.html, and without scoping an active OAuth token check to the requesting client. An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes. This issue is fixed in versions 15.114.0 and 16.26.0.

  14. CVE-2026-63654 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.

  15. CVE-2026-62315 7.1 Élevée

    frappe

    Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.

  16. CVE-2026-53569 5.3 Moyenne

    frappe

    Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata. No released fixed version is available as of this review.

  17. CVE-2026-66000 2.3 Faible

    frappe

    Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.

  18. CVE-2026-66058 5.3 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

  19. CVE-2026-66059 5.3 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

  20. CVE-2026-49391 5.1 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.

  21. CVE-2026-47765 7.1 Élevée

    frappe

    Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0.

  22. CVE-2026-47194 8.6 Élevée

    frappe

    Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3.

  23. CVE-2026-47185 5.1 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.

  24. CVE-2026-58503 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed in versions 16.16.0 and 15.106.0.

  25. CVE-2026-55852 8.6 Élevée

    frappe

    Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.

  26. CVE-2026-49394 7.1 Élevée

    frappe

    Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0.

  27. CVE-2026-48127 5.3 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints such as add_attachments. This issue is fixed in versions 16.20.0 and 15.110.0.

  28. CVE-2026-47422 5.3 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.

  29. CVE-2026-47199 2.3 Faible

    frappe

    Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work on self-hosted sites if database permissions are not well aligned and MySQL FILE privileges are available. This issue is fixed in versions 16.18.3 and 15.108.0.

  30. CVE-2026-42219 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.

  31. CVE-2026-41482 7.1 Élevée

    frappe

    Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.

  32. CVE-2026-50712 4.8 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.ui.Tree component

  33. CVE-2026-50711 4.6 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Number Card component.

  34. CVE-2026-50710 4.6 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component.

  35. CVE-2026-50709 4.8 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Notifications > Events panel.

  36. CVE-2026-50708 4.8 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component.

  37. CVE-2026-50705 4.6 Moyenne

    Frappe Framework

    A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboard headline renderer.

  38. CVE-2026-50704 4.6 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the File View breadcrumb renderer.

  39. CVE-2026-50703 4.8 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer.

  40. CVE-2026-50701 5.1 Moyenne

    Frappe Framework

    A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component.

  41. CVE-2026-50700 4.6 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function.

  42. CVE-2026-50699 4.6 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in reference_document using a whitelisted write path and trigger script execution when users open the affected Auto Repeat form.

  43. CVE-2026-50698 4.6 Moyenne

    Frappe Framework

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component.

  44. CVE-2026-53568 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This issue has been patched in versions 15.107.2 and 16.17.4.

  45. CVE-2026-50026 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.

  46. CVE-2026-47182 5.3 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This issue has been patched in version 16.17.4.

  47. CVE-2026-44976 5.3 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4.

  48. CVE-2026-44975 5.3 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the system. This issue has been patched in versions 15.107.2 and 16.17.4.

  49. CVE-2026-44208 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of validations in the "submit_discussion()" endpoint allows for unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.

  50. CVE-2026-44207 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configuration details. This issue has been patched in versions 15.107.0 and 16.17.0.

  51. CVE-2026-44206 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4.

  52. CVE-2026-47739 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0.

  53. CVE-2026-44205 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0.

  54. CVE-2026-41581 6.9 Moyenne

    frappe

    Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has been patched in versions 15.106.0 and 16.16.0.

  55. CVE-2026-39352 8.7 Élevée

    frappe

    Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.

  56. CVE-2023-54345 8.8 Élevée

    Frappe Technologies Frappe Framework (ERPNext) · Frappe erpnext

    Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.