Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

frappe — Vulnerabilities & Security Advisories 91

All 91 CVE vulnerabilities found in frappe, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerabilities affecting Frappe, the open-source framework and its associated platforms such as ERPNext. It collects known security flaws including authentication weaknesses, input validation errors, and server-side issues reported across various release versions. The data spans from the earliest publicly disclosed advisories through the most recent updates. Readers can use this aggregation to track the vendor’s advisory timeline, understand the prevalence of specific weakness classes like injection or access control failures, and review the complete vulnerability history of the Frappe product line. The collection is organized by release version and severity, allowing users to identify patterns in how the framework evolves security-wise. This resource serves as a centralized reference for security teams managing deployments, enabling them to correlate individual CVE records with broader vulnerability trends without needing to parse multiple separate feeds. All entries are verified against public advisories and community reports, ensuring the data reflects the current state of known flaws.

Vendor: frappe

CVE ID Title CVSS Severity Published
CVE-2026-31877 Frappe SQL Injection due to improper field sanitization CWE-89 7.5AI High AI 2026-03-11
CVE-2026-29081 Frappe: Possibility of SQL Injection due to improper fieldname sanitization CWE-89 6.5 Medium 2026-03-05
CVE-2026-29077 Frappe: Broken Access Control in DocShare CWE-284 7.1 High 2026-03-05
CVE-2026-28436 Frappe: Stored XSS in avatar_macro.html CWE-79 5.4 - 2026-03-05
CVE-2026-25956 Frappe Affected by XSS and Open Redirect in Sign Up CWE-601 6.1 Medium 2026-02-10
CVE-2025-69083 WordPress Frappé theme <= 1.8 - Local File Inclusion vulnerability CWE-98 8.1 High 2026-01-06
CVE-2025-68953 Certain Frappe requests are vulnerable to Path Traversal CWE-22 7.5 High 2026-01-05
CVE-2025-68929 Frappe may be vulnerable remote code execution due to server-side template injection CWE-1336 9.1 Critical 2025-12-29
CVE-2025-66206 Frappe vulnerable to a path traversal allowing reading certain files CWE-22 6.8 Medium 2025-12-01
CVE-2025-66205 Frappe has the possibility of SQL Injection due to improper validations CWE-89 7.1 High 2025-12-01
CVE-2025-62407 Frappe has an Open Redirect on Login Page CWE-601 6.1 Medium 2025-10-16
CVE-2025-55732 Frappe has the possibility of SQL Injection due to improper validations CWE-89 7.5AI High AI 2025-08-20
CVE-2025-55731 Frappe has the possibility of Authenticated SQL Injection due to improper validations CWE-89 7.5AI High AI 2025-08-20
CVE-2025-52898 Frappe account takeover via password reset token leakage CWE-200 9.1AI Critical AI 2025-06-30
CVE-2025-52896 Frappe authenticated XSS via data import CWE-79 5.4AI Medium AI 2025-06-30
CVE-2025-52895 Frappe possibility of SQL injection due to improper validations CWE-89 7.5AI High AI 2025-06-30
CVE-2025-30217 Frappe has possibility of SQL injection due to improper validations CWE-89 7.5AI High AI 2025-03-26
CVE-2025-30214 Frappe vulnerable to information disclosure leading to account takeover CWE-200 8.1AI High AI 2025-03-25
CVE-2025-30213 Frappe has Possibility of Remote Code Execution due to improper validation CWE-20 8.8AI High AI 2025-03-25
CVE-2025-30212 Frappe has possibility of SQL injection due to improper validations CWE-89 7.5AI High AI 2025-03-25
CVE-2024-34074 Frappe vuilnerable to an open redirect on login page CWE-601 6.1 Medium 2024-05-09
CVE-2024-27105 Frappe File Permissions can by bypassed using certain endpoints CWE-863 8.1 High 2024-03-20
CVE-2024-24813 Frappe SQL Injection from reporting logic CWE-89 7.5 High 2024-03-20
CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages CWE-79 5.4 Medium 2024-02-07
CVE-2023-46127 Frappe vulnerable to HTML injection by any Desk user CWE-79 5.4 Medium 2023-10-23
CVE-2023-41328 Possibility limited SQL injection due to insufficient validation in Frappe CWE-89 4.2 Medium 2023-09-06
CVE-2022-41712 Frappe Technologies Frappe 路径遍历漏洞 6.3 - 2022-11-25
CVE-2022-3988 Frappe Search navbar_search.html cross site scripting CWE-707 3.5 Low 2022-11-14
CVE-2022-23055 ERPNext - Improper user access conrol CWE-862 8.1 - 2022-06-22
CVE-2022-23058 ERPNext - Stored XSS in My Settings CWE-79 5.4 - 2022-06-22

All 91 known CVE vulnerabilities affecting frappe with full Chinese analysis, references, and POCs where available.