ERPNext / Frappe vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
40 matching records
- Medium4.3Broken Access Control in File list/report queriesOpen the advisoryOct 23, 2026
- CriticalPossibility of Server Side Template InjectionCheck if you run itEPSS 0.30%Oct 15, 2026
- Critical9.9Remote code execution via path traversalOpen the advisoryOct 15, 2026
- High8.7Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from…Check if you run itEPSS 0.27%Oct 12, 2026
- High7.1Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest u…Check if you run itEPSS 0.22%Oct 12, 2026
- High8.2Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints.Check if you run itEPSS 0.26%Oct 12, 2026
- Medium5.3Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check.Check if you run itEPSS 0.19%Oct 12, 2026
- Medium6.9Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured…Check if you run itEPSS 0.31%Oct 12, 2026
- Medium6.9Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution wh…Check if you run itEPSS 0.32%Oct 12, 2026
- MediumBlind SQL Injection in frappe.desk.doctype.event.event.get_eventsOpen the advisoryOct 7, 2026
- Medium5.4restrict_ip allowlist bypassed for API key, OAuth, and header-based authenticationOpen the advisoryOct 1, 2026
- HighUnauthorized users can send sms via the APIOpen the advisorySep 28, 2026
- MediumStored XSS in dashboard chartOpen the advisorySep 22, 2026
- CriticalArbitrary file read via an attribute in outgoing email HTMLOpen the advisorySep 16, 2026
- Medium5.3Disabled users continue to receive Document Follow email notificationsOpen the advisorySep 11, 2026
- Medium5.1Frappe is a full-stack web application framework.Check if you run itEPSS 0.42%Sep 8, 2026
- HighAccess control bypass via REST APICheck if you run itEPSS 0.42%Aug 18, 2026
- Medium4.3Unauthorised modification of records due to missing validationOpen the advisoryAug 11, 2026
- LowUser Enumeration via PDDRCheck if you run itEPSS 0.82%Aug 11, 2026
- HighImproper Authorization in OAuth2 Consent EndpointCheck if you run itEPSS 0.34%Aug 10, 2026
- LowUnauthenticated Workflow approvalCheck if you run itEPSS 0.26%Aug 10, 2026
- MediumMass assignment in client endpointCheck if you run itEPSS 0.49%Aug 10, 2026
- MediumField-level permission bypass via Document FollowCheck if you run itEPSS 0.48%Jul 30, 2026
- MediumUnrestricted access to a Document Follow APICheck if you run itEPSS 0.38%Jul 30, 2026
- HighTarSlip RCE in Package ImportCheck if you run itEPSS 0.68%Jul 4, 2026