CVE-2026-114664— Frappe before 16.33.0 Blind SQL Injection via get_events
Quick assessment
Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe Framework 16.33.0 之前的版本在 方法中存在盲 SQL 注入漏洞。该漏洞源于在将用户提供的输入纳入 SQL 查询前未能对其进行有效净化。已认证的攻击者可向 方法发送精心构造的输入，并通过观察应用程序的行为来推断查询结果，从而窃取敏感的数据库信息。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114664
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe before 16.33.0 Blind SQL Injection via get_events
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114664
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114664
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114664 (2)
-
-
🔗 Frappe before 16.33.0 Blind SQL Injection via get_events | Advisories | VulnCheck third-party-advisory
IV. Related Vulnerabilities
Same product: frappe
-
CVE-2026-111388
Frappe before 16.33.0 restrict_ip Allowlist Bypass via API K -
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param. -
CVE-2026-109603
Frappe Framework before 16.17.0 Authenticated SSRF and LFI v -
CVE-2026-109602
Frappe before v16.31.0 Stored XSS via Dashboard Chart Filter
Same vendor: frappe
-
CVE-2026-111938
Frappe CRM before 1.74.0 Missing Authorization via add_note_ -
CVE-2026-111939
Frappe Helpdesk before 1.26.0 Authorization Bypass via raise -
CVE-2026-111937
Frappe CRM before 1.81.2 Missing Authorization on CRM Notifi -
CVE-2026-64862
Frappe HR: Missing Authorization on PWA API Endpoints enable -
CVE-2026-55796
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Rep
Same weakness: CWE-89
-
CVE-2026-112327
WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerabil -
CVE-2026-114577
oretnom23 php-travel-agency-system Insertion insert.php sql -
CVE-2026-87936
amazee.ai Private AI Provider - Critical - SQL injection - S -
CVE-2026-87938
CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136 -
CVE-2026-114441
oretnom23 php-travel-agency-system update.php sql injection
V. Comments for CVE-2026-114664
No comments yet