Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

frappe — Vulnerabilities & Security Advisories 74

All 74 CVE vulnerabilities found in frappe, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerabilities affecting Frappe, the open-source framework and its associated platforms such as ERPNext. It collects known security flaws including authentication weaknesses, input validation errors, and server-side issues reported across various release versions. The data spans from the earliest publicly disclosed advisories through the most recent updates. Readers can use this aggregation to track the vendor’s advisory timeline, understand the prevalence of specific weakness classes like injection or access control failures, and review the complete vulnerability history of the Frappe product line. The collection is organized by release version and severity, allowing users to identify patterns in how the framework evolves security-wise. This resource serves as a centralized reference for security teams managing deployments, enabling them to correlate individual CVE records with broader vulnerability trends without needing to parse multiple separate feeds. All entries are verified against public advisories and community reports, ensuring the data reflects the current state of known flaws.

Vendor: frappe

CVE ID Title CVSS Severity Published
CVE-2023-51769 Frappe 跨站脚本漏洞 CWE-79 6.1 Medium 2026-09-14
CVE-2026-82634 Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint CWE-863 6.5 Medium 2026-08-30
CVE-2026-81731 Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description CWE-79 5.4 Medium 2026-08-27
CVE-2026-66003 Frappe: Access control bypass via REST API dot-notation fields on linked doctypes CWE-863 7.1 High 2026-08-26
CVE-2026-66002 Frappe: User Enumeration via PDDR CWE-204 6.9 Medium 2026-08-20
CVE-2026-66001 Frappe: Improper Authorization in OAuth2 Consent Endpoint CWE-352 8.5 High 2026-08-20
CVE-2026-62315 Frappe: Mass assignment via set_value CWE-915 7.1 High 2026-08-20
CVE-2026-63654 Frappe: Unauthenticated Workflow approval via confirm_action CWE-352 6.9 Medium 2026-08-20
CVE-2026-53569 Frappe: Missing authorization in toggle_like and mark_as_seen CWE-862 5.3 Medium 2026-08-20
CVE-2026-66000 Frappe: Unrestricted access to Document Follow APIs CWE-863 2.3 Low 2026-08-07
CVE-2025-58375 Frappe has potential SQL Injection due to missing validation CWE-89 8.1 High 2026-08-07
CVE-2026-66058 Frappe: Unrestricted access to a Document Follow API CWE-862 5.3 Medium 2026-08-07
CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow CWE-863 5.3 Medium 2026-08-07
CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import CWE-79 5.1 Medium 2026-08-06
CVE-2026-47765 Frappe: Lack of Permissions in restore/bulk_restore CWE-862 7.1 High 2026-08-06
CVE-2026-47194 Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain CWE-346 8.6 High 2026-08-06
CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API CWE-863 5.1 Medium 2026-08-06
CVE-2026-55852 Frappe: TarSlip RCE in Package Import CWE-22 - - 2026-07-10
CVE-2026-42219 Frappe: Path Traversal via /backups Route CWE-22 - - 2026-07-10
CVE-2026-49394 Frappe: Auth. bypass via update_page CWE-862 - - 2026-07-10
CVE-2026-48127 Frappe: Arbitrary Attachment Injection via add_attachments and upload_file CWE-862 - - 2026-07-10
CVE-2026-41482 Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator CWE-22 - - 2026-07-10
CVE-2026-47199 Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE CWE-89 - - 2026-07-10
CVE-2026-58503 Frappe: Unauthenticated User Enumeration via reset_password CWE-203 - - 2026-07-10
CVE-2026-47422 Frappe: Unrestricted API access to save_report CWE-862 - - 2026-07-10
CVE-2026-53568 Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value' CWE-79 - - 2026-06-12
CVE-2026-50026 Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints CWE-862 - - 2026-06-12
CVE-2026-47182 Frappe: Broken Access Control on Private Files CWE-284 - - 2026-06-12
CVE-2026-44976 Frappe: IDOR in update_onboarding_step CWE-284 - - 2026-06-12
CVE-2026-44975 Frappe: Missing authorization on reset form tours CWE-862 - - 2026-06-12

All 74 known CVE vulnerabilities affecting frappe with full Chinese analysis, references, and POCs where available.