Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

frappe — Vulnerabilities & Security Advisories 91

All 91 CVE vulnerabilities found in frappe, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerabilities affecting Frappe, the open-source framework and its associated platforms such as ERPNext. It collects known security flaws including authentication weaknesses, input validation errors, and server-side issues reported across various release versions. The data spans from the earliest publicly disclosed advisories through the most recent updates. Readers can use this aggregation to track the vendor’s advisory timeline, understand the prevalence of specific weakness classes like injection or access control failures, and review the complete vulnerability history of the Frappe product line. The collection is organized by release version and severity, allowing users to identify patterns in how the framework evolves security-wise. This resource serves as a centralized reference for security teams managing deployments, enabling them to correlate individual CVE records with broader vulnerability trends without needing to parse multiple separate feeds. All entries are verified against public advisories and community reports, ensuring the data reflects the current state of known flaws.

Vendor: frappe

CVE ID Title CVSS Severity Published
CVE-2026-109603 Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit CWE-918 3.3 Low 2026-10-12
CVE-2026-109602 Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters CWE-79 5.4 Medium 2026-10-12
CVE-2026-109601 Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML CWE-73 6.5 Medium 2026-10-12
CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications CWE-862 5.3 Medium 2026-10-12
CVE-2026-109599 Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification CWE-862 4.3 Medium 2026-10-12
CVE-2026-109598 Frappe before 16.33.0 Broken Authorization via send_sms Endpoint CWE-862 4.3 Medium 2026-10-12
CVE-2025-71431 Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters CWE-90 5.3 Medium 2026-10-12
CVE-2025-71430 Frappe before 15.91.1 Stored XSS via Leaderboard User Names CWE-79 5.4 Medium 2026-10-12
CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters CWE-79 4.3 Medium 2026-10-12
CVE-2023-54412 Frappe before 13.46.3 Improper Access Control for Email Templates CWE-284 6.5 Medium 2026-10-12
CVE-2024-58390 Frappe before 15.41.0 Privilege Escalation via Document Action CWE-269 8.8 High 2026-10-12
CVE-2023-54411 Frappe before 13.32.0 Weak Authentication via Print View Key CWE-290 5.9 Medium 2026-10-12
CVE-2023-54410 Frappe before 13.22.0 Improper Authorization via Document Rename CWE-285 4.3 Medium 2026-10-12
CVE-2023-54409 Frappe before 13.46.1 XSS via html2text Weak Sanitization CWE-80 4.8 Medium 2026-10-12
CVE-2023-54408 Frappe before 14.31.0 HTML Injection via Weak Escaping CWE-79 6.1 Medium 2026-10-12
CVE-2023-54407 Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks CWE-532 4.9 Medium 2026-10-12
CVE-2023-54406 Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts CWE-372 4.9 Medium 2026-10-12
CVE-2023-51769 Frappe 跨站脚本漏洞 CWE-79 6.1 Medium 2026-09-14
CVE-2026-82634 Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint CWE-863 6.5 Medium 2026-08-30
CVE-2026-81731 Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description CWE-79 5.4 Medium 2026-08-27
CVE-2026-66003 Frappe: Access control bypass via REST API dot-notation fields on linked doctypes CWE-863 7.1 High 2026-08-26
CVE-2026-66002 Frappe: User Enumeration via PDDR CWE-204 6.9 Medium 2026-08-20
CVE-2026-66001 Frappe: Improper Authorization in OAuth2 Consent Endpoint CWE-352 8.5 High 2026-08-20
CVE-2026-62315 Frappe: Mass assignment via set_value CWE-915 7.1 High 2026-08-20
CVE-2026-63654 Frappe: Unauthenticated Workflow approval via confirm_action CWE-352 6.9 Medium 2026-08-20
CVE-2026-53569 Frappe: Missing authorization in toggle_like and mark_as_seen CWE-862 5.3 Medium 2026-08-20
CVE-2026-66000 Frappe: Unrestricted access to Document Follow APIs CWE-863 2.3 Low 2026-08-07
CVE-2025-58375 Frappe has potential SQL Injection due to missing validation CWE-89 8.1 High 2026-08-07
CVE-2026-66058 Frappe: Unrestricted access to a Document Follow API CWE-862 5.3 Medium 2026-08-07
CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow CWE-863 5.3 Medium 2026-08-07

All 91 known CVE vulnerabilities affecting frappe with full Chinese analysis, references, and POCs where available.