ZeroDay Findings
Sign inSign up

Findings

CVE-2026-31877

Frappe is a full-stack web application framework.

Published Mar 11, 2026 · updated Jun 17, 2026 · frappe frappe

Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 11, 2026 · NIST NVD

    Detected

    Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0.

  2. Jun 17, 2026 · NIST NVD

    Updated

    Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0.

Affected

  • cpe frappe/frappeversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-31877

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-31877

    Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.

    nvd.nist.gov

References