Frappe
Monthly
Missing authorization enforcement in certain Frappe ERPNext endpoints allows an authenticated user holding only low-privilege role access to modify documents and records beyond the permissions assigned to their role, affecting all releases before 15.121.1 and 16.x before 16.34.2. Exploitation requires valid ERPNext credentials and the ability to reach the affected endpoints, but no user interaction and no non-default configuration - the flaw lies in the endpoints' own failure to check roles (CWE-862). Impact is bounded to low confidentiality and low integrity effects with no availability impact, no public exploit code has been identified at time of analysis, and the vendor has released patched versions (see advisory GHSA-49wp-r82c-j825).
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 allow authenticated users to modify data beyond their permitted role, compromising data integrity with no confidentiality or availability impact. Exploitation requires a valid low-privilege ERPNext account (PR:L) and reachable endpoints that fail to enforce role-based authorization; anonymous access is not possible, and no public exploit identified at time of analysis. This is a moderate-severity broken access control issue, not a critical flaw.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 let authenticated users with low-privilege roles modify data beyond their assigned permissions through certain network-reachable endpoints. According to the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), exploitation requires a valid authenticated session and results only in limited integrity impact, with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the vendor has released fixed versions 15.121.0 and 16.34.0.
Server-side request forgery and local file inclusion in Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 allow an authenticated user who can render user-controllable content to PDF to make the server fetch internal resources or embed local server files into the resulting PDF. The root cause is Frappe's dependency on a vulnerable version of the pdfkit library (CVE-2025-26240), which resolves external URLs and file references during server-side PDF rendering. The assessed vector is network-accessible but requires a valid Frappe account with access to a PDF-generating feature (print formats, templates, or report-to-PDF flows), and impact is limited to confidentiality; it is a medium-severity, low-priority issue for most deployments, and no public exploit was identified at time of analysis.
Stored cross-site scripting (XSS) in Frappe versions prior to 15.118.0 and 16.x before 16.31.0 allows authenticated attackers with dashboard chart editing privileges to inject malicious filter values that execute in the browsers of users who view the affected chart. The vulnerability arises because jQuery renders filter values as rich text instead of escaping them. Exploitation requires the victim to open the dashboard chart, and no public exploit code has been identified at time of analysis. This medium-severity issue (CVSS 5.1) can lead to session hijacking or other client-side attacks for the viewing user.
Disabled Frappe Framework user accounts can continue receiving Document Follow email notifications in versions before 15.118.0 and 16.x before 16.31.0, disclosing document activity to users whose access should have been revoked. Exploitation requires that the affected account previously followed one or more documents while active and was later disabled rather than deleted; it does not grant new document access or enable arbitrary external attackers to access documents. The independent assessment rates this as a missing-authorization information-disclosure flaw with low confidentiality impact (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:L/I:N/A:N); no public exploit identified at time of analysis.
Missing authorization checks in Frappe versions before 15.113.3 and 16.x before 16.25.0 allow authenticated users with low-privilege roles to modify records beyond their assigned permissions via crafted API requests to certain endpoints. Exploitation requires a valid authenticated session (PR:L) and impacts only integrity, with no confidentiality or availability impact. No public exploit has been identified at time of analysis, and the flaw is fixed in versions 15.113.3 and 16.25.0.
Missing authorization in Frappe Framework's whitelisted send_sms API endpoint allows any authenticated low-privilege user who lacks SMS-sending permissions to send arbitrary SMS messages that impersonate the Company, affecting releases before 15.120.0 and 16.x before 16.33.0. Exploitation requires a valid Frappe session (PR:L per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and no user interaction, but impact is confined to integrity/impersonation of outbound messaging with no data disclosure or service disruption, and is further gated by whether the instance has a functioning SMS gateway configured. No public exploit code was identified at time of analysis, and this is assessed as a medium/low-priority issue rather than a high-severity emergency.
Reflected cross-site scripting in Frappe ERPNext (all versions before 14.92.1, and 15.x before 15.83.0) lets an attacker inject arbitrary JavaScript that runs inside an authenticated user's session, enabling session/account takeover. The attacker needs no credentials (PR:N in the CVSS vectors), but exploitation requires a logged-in victim to follow a crafted URL (UI:P), so it is delivered by phishing or social engineering rather than by a direct server-side attack. Impact is rated high for confidentiality and integrity (VC:H/VI:H) with scope change under the CVSS 4.0 vector (8.6) and CVSS 3.1 equivalent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N); there is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is lower priority than a zero-interaction network RCE.
LDAP injection (CWE-90) in Frappe Framework allows unauthenticated remote attackers to manipulate directory queries by injecting crafted LDAP filter syntax through unsanitized endpoint parameters, with an impact limited to information disclosure (VC:L, VI:N, VA:N). The flaw affects Frappe releases before 14.99.2 and 15.x releases before 15.86.0, and is rated 6.3 under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N); exploitability is conditional because the instance must have LDAP integration actively configured, which is the attack requirement reflected by AT:P. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting (CWE-79) in the Frappe framework's leaderboard page allows an authenticated user to persist a crafted display name whose payload executes in the browsers of other users who open the leaderboard, in all versions before 14.99.10 and 15.x before 15.91.1. Because the name is stored server-side and rendered on a shared page, the payload fires for every visitor without further attacker interaction, giving cross-site scripting in the context of the Frappe application's origin. Exploitation requires a valid account capable of setting its own user name (PR:L) plus a victim navigating to the leaderboard (UI:P); no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 4.0 base score of 5.1 (MEDIUM) reflects the limited direct confidentiality/integrity impact on the vulnerable system offset by scope change to the victim's browser session.
Authenticated Frappe CRM users can read linked-document details for records they are not permitted to view, because the API method crm.api.doc.get_linked_docs_of_document in versions 1.49.0 through 1.87.0 resolves leads, deals, comments, and users by name without applying Frappe's permission checks. By supplying the name of a document they cannot legitimately access, any logged-in account - even a low-trust or self-service one - can extract linked call-log phone numbers, deal organization names, and mention notification text. The flaw is a genuine but modest information-disclosure issue (CVSS 5.3), limited to read-only metadata with no write, modification, or denial-of-service impact; no public exploit was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Missing authorization in Frappe HR (hrms) lets any authenticated user - including ordinary employees with no HR role - zero out another employee's leave allocation by POSTing the target Leave Allocation record name to the whitelisted expire_allocation method, silently wiping that employee's remaining leave balance. The flaw affects all 14.x and 15.x releases through 15.64.3 and every build before 16.11.0, is exploitable in the default configuration with only a low-privileged session and no victim interaction, and is confined to data integrity (no confidentiality or availability impact). No public exploit identified at time of analysis, and a vendor-released patch (16.11.0) is available, so this is best treated as a medium-severity, insider-oriented data-integrity issue rather than a mass-exploitation emergency.
Authenticated users of Frappe HR (hrms) - including accounts holding no HR role whatsoever - can read other employees' net pay along with loan, advance, and expense-claim balances by calling the whitelisted get_account_and_amount method over /api/method. Affected releases are all 14.x and 15.x builds through 15.64.3, plus any pre-16.11.0 build; the endpoint ships whitelisted by default and requires no non-default configuration or user interaction, only a valid low-privileged session (CVSS 4.0 score 5.3, PR:L, confidentiality-only impact). Exploitation is a straightforward IDOR-style enumeration exercise because Salary Slip and claim document names are sequential and guessable, so an attacker can harvest amounts systematically; CISA KEV does not list this issue and no public exploit code has been confirmed, although a public technical writeup describing the payroll "amount oracle" is referenced in the advisory data, making the technique widely discoverable.
Missing authorization in Frappe Raven 2.0.0 through 3.0.0 lets an authenticated user with the Raven User role join Public workspaces that are configured as invite-only, because the can_only_join_via_invite setting is not enforced by the join_workspace API. The practical consequence is unauthorized persistent membership in those workspaces, allowing the attacker to read and post messages in the associated Public and Open channels, but not to reach private data or administrative functions. Exploitation requires a valid authenticated account and a target that is specifically a Public workspace with invite-only enabled; no public exploit code has been identified at time of analysis, and EPSS/KEV signals are absent, so this rates as a medium-severity, low-to-moderate real-world risk.
Authenticated attackers can read other employees' expense claims, shift requests, and attendance records in Frappe HR up to 16.15.0 by exploiting an incorrect authorization flaw in the get_expense_claims, get_shift_requests, and get_attendance_requests API endpoints. The vulnerability requires a valid low-privilege session but no special permissions, and the vendor has confirmed the issue is fixed. No public exploit identified at time of analysis; the impact is limited to information disclosure (CVSS 5.3, MEDIUM).
Authenticated users holding the ERPNext Accounts Manager role can invoke arbitrary non-whitelisted server-side Python methods and read back their return values in Frappe ERPNext versions before 16.34.1. The flaw lives in Financial Report Template handling: a Custom API row's calculation_formula is passed straight to frappe.call() without verifying that the dotted path resolves to a whitelisted, GET-permitting method, so an attacker with rights to create or edit such templates can point the formula at internal methods that were never meant to be remotely callable. The assessed impact is limited information disclosure and limited integrity impact (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; CVSS 4.0 5.3), exploitation requires a privileged non-default role, no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data indicates active exploitation. This is a genuine but modest-severity issue best treated as medium-low priority.
Stored XSS in Frappe's workspace link description feature (versions 15.11.0-16.32.0) allows any user holding the Workspace Manager role to inject arbitrary JavaScript into a public workspace card, which executes in the browser session of any desk user who opens the workspace and hovers over the card description. The attack path reaches higher-privileged users through shared public workspaces, enabling session token theft and impersonation via authenticated API requests as the victim. No released version carries the fix; the upstream correction exists only on the development branch per commit 9f65e5ceca71aae91dcfd9bb3c0904afd386a01a, leaving all 15.x and 16.x deployments exposed.
User enumeration via observable response discrepancy in Frappe's personal data download (GDPR) endpoint allows unauthenticated remote attackers to determine whether any email address corresponds to a registered account. The PersonalDataDownloadRequest handler in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py returned the user_name field and persisted the document to the database only for known users, producing structurally distinct responses that an attacker could compare to systematically harvest registered email addresses. No public exploit has been identified at time of analysis; vendor-released patches exist at versions 15.115.0 and 16.27.0.
Cross-Site Request Forgery in Frappe Framework 16.31.0 and earlier allows an unauthenticated attacker to forge workflow approval actions on behalf of any authenticated victim user, because the bulk_workflow_approval endpoint in frappe/model/workflow.py accepts state-mutating requests via safe HTTP methods (GET) in addition to POST. The attacker needs only to lure an authenticated user to a crafted page or link, causing their browser to silently submit an approval with the victim's session credentials. No released patched version is available at time of analysis; the upstream fix exists only as an unmerged PR and commit.
Missing authorization on the toggle_like and mark_as_seen endpoints in Frappe Framework 16.31.0 and earlier allows authenticated users to interact with documents and notes they lack read access to. Any valid session holder can call these whitelisted endpoints with arbitrary doctype and document name parameters, confirming resource existence and modifying _liked_by metadata or note-seen state without a permission check. No public exploit has been identified at time of analysis, but an upstream fix exists in pull request #39760 with no released patched version confirmed.
SQL injection in ERPNext's tax rule engine allows any authenticated low-privilege user to extract arbitrary database content. The get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py directly interpolated request-supplied posting_date and args dictionary values into raw SQL WHERE clauses via Python f-strings and .format() calls, bypassing all parameterization. Vendor-released patches exist as versions 15.109.0 and 16.20.0; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization in ERPNext's account creation function allows any authenticated low-privilege user to bypass the Account doctype's create permission gate and insert unauthorized chart-of-accounts entries, directly corrupting financial data integrity and audit trails. All ERPNext releases prior to v15.111.0 (v15 branch) and v16.22.0 (v16 branch) are affected, as confirmed by vendor security advisory GHSA-94v6-784v-24q5 and the published PR diff. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in ERPNext's Process Statement of Accounts module allows any authenticated low-privilege user to invoke the send_emails function and dispatch automated account statement emails to customers without holding the required role. Versions prior to 15.111.0 (v15 branch) and 16.22.0 (v16 branch) are affected across all ERPNext deployments using this accounts feature. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the vendor has released confirmed patches for both active version branches.
Stale permission enforcement in Frappe's Document Follow subsystem allows authenticated users whose document access has been revoked or downgraded to continue receiving document-level data via scheduled email notifications. Affecting all Frappe v15 releases prior to 15.112.0 and v16 releases prior to 16.23.0, the flaw arises because notification generation never re-evaluates whether recipients still hold current read permission on subscribed documents at dispatch time. No public exploit code exists and no active exploitation has been confirmed; the vendor-assigned CVSS 4.0 score of 2.3 accurately reflects the narrow exposure window and the prerequisite that access revocation must have already occurred before the notification job fires.
Field-level permissions bypass in Frappe framework allows authenticated users to read restricted DocType field values via the document follow timeline feature. Frappe deployments on the v16 branch prior to 16.23.0 and the v15 branch prior to 15.112.0 are affected, including ERPNext and other applications built on Frappe. An authenticated low-privileged user can access historical change values for fields protected by Frappe's permlevel system simply by viewing the document follow timeline - no public exploit has been identified and the vulnerability is not listed in CISA KEV.
Path traversal via the download_backups endpoint in Frappe framework exposes arbitrary server-side files to authenticated high-privilege users. Affected versions span the entire v15 branch prior to 15.109.0 and the v16 branch prior to 16.19.0 (CPE: cpe:2.3:a:frappe:frappe:*). An attacker holding administrator-level credentials can craft a traversal payload in the backup download request to read files outside the intended backup directory, achieving high confidentiality impact with no integrity or availability consequence. No public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized file attachment in Frappe, a Python/JavaScript full-stack web framework, allows any authenticated low-privilege user to attach files to arbitrary doctypes through file-handling API endpoints such as add_attachments, bypassing per-document write permission enforcement. Affected are all Frappe v15 releases prior to 15.110.0 and all v16 releases prior to 16.20.0. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network accessibility make exploitation straightforward for any valid account holder on a multi-tenant instance.
Frappe framework's check_safe_sql_query function fails to block SELECT INTO OUTFILE statements, allowing authenticated low-privileged users to write arbitrary files to the server filesystem on self-hosted MySQL deployments where the database user holds the MySQL FILE privilege. Affected branches are v15 prior to 15.108.0 and v16 prior to 16.18.3; fixes are released at both version targets. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, with a CVSS 4.0 base score of 2.3 reflecting the narrow, non-default exploitation conditions captured by AT:P.
User enumeration via the reset_password endpoint in Frappe framework exposes valid account usernames to unauthenticated remote attackers across all versions prior to 15.106.0 and 16.16.0. The flaw stems from observable response discrepancies (CWE-203) that allow systematic probing of registered accounts without any credentials. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the zero-barrier network access makes this a realistic reconnaissance primitive for credential stuffing or targeted phishing campaigns against Frappe-based deployments.
Missing authorization on the reportview endpoint in Frappe framework permits authenticated low-privileged users to access or manipulate report data beyond their permitted scope. Versions prior to 15.107.5 (v15 branch) and 16.18.2 (v16 branch) are affected, confirmed via GitHub Security Advisory GHSA-w8g7-j846-j248. No public exploit or CISA KEV listing exists at time of analysis; the CVSS 4.0 PR:L metric confirms exploitation is bounded by requiring a valid authenticated session.
Stored XSS in Frappe Framework 17.0.0-dev allows authenticated low-privileged users to inject persistent malicious scripts via the frappe.ui.Tree component, which then execute in the browsers of other users who load the affected tree view. Reported by Fluid Attacks, this vulnerability carries a CVSS 4.0 score of 4.8 reflecting cross-user scope change impact despite limited direct system compromise. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows a high-privileged authenticated user to inject persistent malicious scripts into the Number Card dashboard component, which then execute in the browsers of other users who view the affected dashboard. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation requires admin-level access to plant the payload and a victim's browser interaction to trigger it, limiting realistic blast radius despite the network delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in Frappe Framework version 17.0.0-dev allows a high-privileged authenticated user to inject malicious JavaScript through the Number Card dashboard component, which subsequently executes in other authenticated users' browser sessions when they view affected dashboards. The CVSS 4.0 score of 4.6 (Medium) reflects the dual constraint of requiring high-privilege credentials to plant the payload and active victim interaction to trigger it - both of which meaningfully limit real-world exploitability. No public exploit code or CISA KEV listing is identified at time of analysis; this was reported by Fluid Attacks.
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated low-privileged user to inject persistent JavaScript payloads via the Notifications > Events panel, which execute in the browser context of any user who subsequently views that panel. The CVSS 4.0 vector confirms subsequent-system scope impact (SC:L/SI:L), meaning the attack targets other users rather than the attacker's own session. No public exploit has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored XSS in Frappe Framework 17.0.0-dev's MultiSelectDialog component allows authenticated low-privileged attackers to inject persistent malicious scripts that execute in other users' browsers when the compromised UI element is rendered. Per the CVSS 4.0 vector (PR:L/UI:A/SC:L/SI:L), exploitation requires a valid low-privilege account and active victim interaction, but the scope change to the subsequent system confirms cross-user impact on confidentiality and integrity. No public exploit code and no CISA KEV listing exist at time of analysis; the 17.0.0-dev designation suggests exposure may currently be limited to pre-release or development deployments.
Cross-site scripting in Frappe Framework 17.0.0-dev allows a high-privileged attacker who can modify the Form Dashboard headline to inject malicious JavaScript that executes in the browsers of other users who subsequently view the affected form. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation is gated behind two significant barriers: attacker must hold high-privilege application credentials and a victim must actively navigate to the injected form. No public exploit code and no active exploitation (CISA KEV) have been identified at the time of analysis; this was reported by Fluid Attacks.
Stored XSS in Frappe Framework 17.0.0-dev allows a high-privileged attacker to inject persistent malicious scripts into the File View breadcrumb renderer, which then execute in the browsers of other users who navigate to the affected view. The CVSS 4.0 vector (PR:H, UI:A, SC:L/SI:L) confirms that while network delivery is possible, exploitation is constrained by the need for elevated access to inject the payload and victim interaction to trigger it, with impact limited to the subsequent system (victim browser). No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated low-privileged user to inject persistent malicious scripts via the Desk desktop icon renderer, which then execute in the browsers of other users - including administrators - who subsequently view the affected Desk interface. The vulnerability was reported by Fluid Attacks and carries a CVSS 4.0 score of 4.8 (Medium), reflecting cross-user impact limited to the subsequent-system scope (SC:L/SI:L). No public exploit code or active exploitation has been identified at time of analysis.
Reflected Cross-Site Scripting in Frappe Framework 17.0.0-dev's dashboard-view component allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms no authentication is required from the attacker, though victim interaction is mandatory. Impact is confined to the subsequent system (victim browser session), with low integrity and confidentiality consequences; no active exploitation or public POC has been identified at time of analysis.
Stored XSS in Frappe Framework 17.0.0-dev allows high-privileged authenticated attackers to inject persistent malicious scripts via the `frappe.get_avatar` function, which execute in victims' browsers when the crafted content is rendered. The CVSS 4.0 score of 4.6 (Medium) reflects the PR:H requirement to store the payload and UI:A requirement for victim interaction, with impact limited to subsequent systems (other users' sessions). No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated attacker with write access to the Auto Repeat module to inject persistent HTML/JavaScript into the reference_document field via a whitelisted write path, bypassing server-side input controls. When any user opens the affected Auto Repeat form, the injected payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized UI manipulation on behalf of the victim. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; however, the stored (persistent) nature of this XSS makes it more dangerous than reflected variants within shared Frappe deployments.
Stored XSS in Frappe Framework 17.0.0-dev allows a high-privileged authenticated attacker to inject persistent malicious scripts into the Audit Trail component, which then execute in the browsers of other privileged users who view that trail. The vulnerability arises from improper input neutralization (CWE-79) before HTML rendering in the audit logging subsystem, and is assigned a CVSS 4.0 score of 4.6 reflecting the high-privilege prerequisite and required victim interaction. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Stored XSS in Frappe's Report and List View components allows injection of persistent JavaScript payloads that execute in the browsers of any user who subsequently accesses the affected views. All Frappe deployments on the v15 branch prior to 15.107.2 and v16 branch prior to 16.17.4 are affected per the GitHub security advisory GHSA-rx63-c3fh-8926. No public exploit has been identified at time of analysis and the EPSS score of 0.02% (7th percentile) reflects low current exploitation probability, though the network-accessible nature of Frappe instances keeps this relevant for organizations running unpatched versions.
Missing authorization checks on multiple Frappe framework endpoints allow remote unauthenticated attackers to access and modify resources without permission. All Frappe installations on the 15.x branch prior to 15.107.0 and the 16.x branch prior to 16.17.0 are affected. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% reflects minimal current exploitation activity, though the attack requires no credentials or special preconditions.
Improper access control in Frappe Framework (all versions prior to 16.17.4) allows any authenticated user to retrieve private files by guessing their server-side file path, bypassing intended authorization restrictions. The flaw is classified under CWE-284 (Improper Access Control) and affects the file-serving layer of the framework, which underlies widely deployed applications such as ERPNext. No public exploit code has been identified at time of analysis, and exploitation probability is very low per EPSS (0.02%, 7th percentile), though the low attack complexity makes it straightforward for any credentialed user to attempt.
Improper access control in Frappe prior to 16.17.4 permits any authenticated user to modify any field in any Onboarding Step record, bypassing expected privilege restrictions. Affected deployments running versions below 16.17.4 expose their onboarding configuration data to unauthorized tampering by low-privileged users. EPSS is extremely low (0.02%, 5th percentile), no public exploit code has been identified, and the vulnerability is not listed in CISA KEV, suggesting no observed active exploitation at time of analysis.
Missing authorization in Frappe allows any authenticated low-privileged user to invoke the onboarding reset function and wipe onboarding state for all users system-wide, affecting all releases before 15.107.2 and 16.17.4. The CWE-862 root cause indicates the reset endpoint performs no role or privilege check before executing a privileged, system-wide operation. No public exploit code exists and EPSS sits at 0.02% (5th percentile), placing real-world exploitation risk at the lower end despite the disruptive potential of forcing every user through onboarding flows on next login.
DB schema enumeration in Frappe (versions prior to 15.107.2 and 16.17.4) exposes internal database structure to unauthenticated remote attackers via a vulnerable endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, making this accessible to any internet-facing instance. While limited to low confidentiality impact (VC:L) with no integrity or availability consequences, schema information can inform targeted follow-on attacks against the application's data layer. No public exploit has been identified at time of analysis, and EPSS of 0.02% (7th percentile) indicates low current exploitation probability.
Insecure Direct Object Reference (IDOR) in the Frappe full-stack web application framework exposes email configuration details of arbitrary users to any authenticated account. The flaw exists in versions prior to 15.107.0 (v15 branch) and 16.17.0 (v16 branch), allowing a low-privilege authenticated attacker to enumerate and read email settings belonging to other users by manipulating object references in requests. No public exploit has been identified and the issue is not listed in CISA KEV, though the low EPSS score (0.02%) and network-accessible vector warrant patching, particularly for multi-tenant Frappe deployments.
Unauthorized resource access in the Frappe web application framework exposes the submit_discussion() endpoint to unauthenticated network callers who can bypass access controls and write discussion data to resources they do not own. All Frappe deployments running versions prior to 15.107.0 (v15 branch) or 16.17.0 (v16 branch) are affected, with impact limited to low-severity integrity writes and no confidentiality or availability consequence. No public exploit code exists and EPSS probability is 0.03% (9th percentile), indicating low opportunistic exploitation pressure despite the unauthenticated network attack vector.
Stored cross-site scripting in Frappe's user profile image section enables script injection that executes in the browsers of any user who views the compromised profile. Affected versions are all Frappe releases prior to 15.106.0. No public exploit code or CISA KEV listing exists at time of analysis; EPSS of 0.02% (7th percentile) reflects low observed exploitation activity, though stored XSS in a shared framework carries inherent persistence risk across all applications built on Frappe.
SQL Injection in the Frappe full-stack web framework's get_blog_list function allows unauthenticated remote attackers to manipulate database queries, leading to limited data read and write access. Frappe versions prior to 15.106.0 (v15 branch) and 16.16.0 (v16 branch) are affected across all deployments that expose the blog module. No public exploit code has been identified and exploitation probability is very low per EPSS (0.02%), though the network-accessible, unauthenticated attack surface warrants prompt patching for internet-facing instances.
Stored cross-site scripting in the Frappe framework's Note feature allows a low-privileged attacker to persist malicious JavaScript that executes in the browsers of users who subsequently view the poisoned note. All Frappe deployments on the v15 branch prior to 15.106.0 and the v16 branch prior to 16.16.0 are affected. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed patches are available and should be applied promptly given the ease of exploitation once an attacker holds any valid user account.
Metadata injection in Frappe LMS prior to version 2.53.0 enables authenticated users to embed crafted content into user-editable fields that, when reflected in page metadata, silently redirects visiting users' browsers to an attacker-controlled URL. Exploitation requires a low-privilege account (PR:L) and passive victim interaction (UI:P) - a target must visit a page containing the poisoned content. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; its CVSS 4.0 score of 2.1 reflects genuinely low severity, though the redirect capability carries downstream phishing and credential-harvesting risk.
Stored cross-site scripting in ERPNext 16.16.0 allows an authenticated user holding Item record edit permissions to persist malicious HTML/JavaScript in the item_name, description, or image fields, which executes unescaped in the Point of Sale (POS) cart interface for any operator who subsequently adds that item to a transaction. Reported by Fluid Attacks (EUVD-2026-34158), this is a stored XSS with lateral impact across all POS operator sessions exposed to the poisoned item record. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 4.8 reflects the constrained attack surface imposed by high privilege prerequisites and required passive user interaction.
Stored cross-site scripting in ERPNext 16.16.0 allows authenticated users to inject arbitrary HTML and JavaScript into the email_id or mobile_no fields of Customer records, which execute silently in the browser of every Point of Sale (POS) operator who subsequently selects the poisoned customer. Because the payload persists in the database, a single injection event affects all future POS operator sessions that encounter that customer - creating a multiplier effect without requiring repeated attacker access. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided in available intelligence sources.
Insufficient authorization enforcement on specific ERPNext endpoints allows authenticated low-privilege users to read sensitive data beyond their permitted role and make limited unauthorized data modifications. Affecting all ERPNext deployments prior to 15.102.0 (v15 branch) and prior to 16.11.0 (v16 branch), an attacker holding any valid user account can invoke unprotected server-side endpoints to access restricted records or alter data outside their role scope. No public exploit code exists and SSVC confirms no active exploitation, but the high confidentiality impact (CVSS C:H) warrants prompt patching - particularly on internet-exposed ERPNext instances where low-privilege accounts may be broadly distributed.
XML External Entity (XXE) injection in ERPNext's EDI Module allows authenticated low-privilege attackers to read arbitrary files from the server's local filesystem, including sensitive configuration files that may contain database credentials or API keys. Affected are all ERPNext installations on the v15 branch prior to 15.104.3 and on the v16 branch prior to 16.12.0 (cpe:2.3:a:frappe:erpnext:*). No public exploit identified at time of analysis, EPSS exploitation probability sits at 0.06% (18th percentile), and CISA SSVC assesses exploitation as none and the attack as non-automatable - collectively placing this at lower operational priority despite its network-accessible attack vector.
Server-Side Request Forgery (SSRF) in ERPNext allows an authenticated remote attacker to send a crafted request to a vulnerable endpoint, causing the ERPNext server to issue arbitrary outbound HTTP calls to attacker-controlled services. The CVSS Changed scope (S:C) indicates the impact extends beyond the application itself, enabling potential access to internal network resources, cloud metadata services, or other intranet endpoints not otherwise reachable by the attacker. Vendor-released patches exist in versions 15.106.0 and 16.16.0; no active exploitation has been confirmed (not listed in CISA KEV) and EPSS sits at a very low 0.02%.
Path traversal in ERPNext exposes arbitrary server files to authenticated low-privileged users via a vulnerable endpoint that fails to restrict directory access. Affected versions are ERPNext prior to 15.101.1 and the 16.x beta line prior to 16.10.0, packaged under CPE cpe:2.3:a:frappe:erpnext. An attacker with a valid account can craft a request to read sensitive files outside the intended directory scope, resulting in full confidentiality compromise of the host filesystem. No public exploit identified at time of analysis, and CISA SSVC signals no active exploitation.
Reflected cross-site scripting (XSS) in Frappe Press login page redirect parameter allows unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser upon clicking a malicious link, with user interaction required. The vulnerability affects all versions prior to the patch commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6, which restricts redirects to internal URLs only. CVSS score of 1.3 reflects very low confidentiality, integrity, and availability impact due to scope limitations, though XSS vulnerabilities carry inherent session hijacking and credential theft risks.
Frappe Press `create_api_secret` endpoint accepts GET requests despite performing database writes, enabling Cross-Site Request Forgery (CSRF)-like attacks where unauthenticated remote attackers can create API secrets by tricking authenticated users into visiting a malicious URL. No public exploit code or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting (XSS) in Frappe 16.10.0 allows authenticated attackers with high privileges to inject malicious scripts into document fields, which execute in the browser of any user who subsequently opens the affected document in Desk. The vulnerability stems from unsafe HTML interpolation in multiple formatter implementations that fail to escape user-supplied values, enabling persistent client-side code execution with limited scope (low integrity/availability impact). CVSS 4.6 reflects the requirement for authenticated high-privilege access and user interaction, but the XSS vector represents a significant persistence and social engineering risk in collaborative document environments.
Stored cross-site scripting (XSS) in Frappe 16.10.10 allows authenticated attackers with high privileges to inject malicious JavaScript via crafted tag values in the _user_tags field, which execute when victims open list or report views. The vulnerability stems from unescaped interpolation of tag content into HTML attributes and element content. Exploitation requires user interaction (victim must open affected view) and high-level authentication, but results in session hijacking or data theft with partial technical impact; CISA SSVC framework rates this as exploitable via proof-of-concept with partial technical impact.
SQL injection in Frappe HR (HRMS) exposes sensitive human resources data to authenticated remote attackers via a specially crafted request to an undisclosed endpoint. Affected installations running versions prior to 15.54.0 (v15 branch) or 14.38.1 (v14 branch) are vulnerable to unauthorized data extraction through unsanitized query parameters. No public exploit code has been identified and CISA KEV does not list this CVE; EPSS at 0.03% (10th percentile) and SSVC exploitation status of 'none' collectively indicate low current threat actor interest, though the C:H CVSS impact reflects meaningful data exposure risk for organizations handling employee records.
Unauthorized file access in Frappe HRMS allows any authenticated user to retrieve files attached to documents they are not permitted to view by calling the attachment API endpoint without proper authorization enforcement. Affected versions span both the v15 branch (prior to 15.58.2) and v16 branch (prior to 16.4.2); patched releases are available from the vendor. No public exploit exists and EPSS is 0.03% (8th percentile), though the confidentiality impact is significant given that HR systems routinely store payroll records, employment contracts, and personal employee data.
Unauthorized employee data disclosure in Frappe HRMS allows any authenticated user holding only a default role to retrieve private employee fields via an insufficiently access-controlled API endpoint in the Roster shift assignment module. Affected versions span the v15 branch prior to 15.58.1 and the v16 branch prior to 16.4.1. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile), and CISA SSVC rates exploitation as none with partial technical impact.
Frappe Learning Management System versions prior to 2.46.0 allow authenticated students to modify their own quiz scores via client-side manipulation using browser developer tools before submission. This vulnerability compromises the integrity of quiz results and academic reliability without enabling privilege escalation, unauthorized account access, or exposure of confidential information. The fix is available in version 2.46.0, and no public exploit code or active exploitation has been identified at the time of analysis.
Frappe web application framework prior to versions 16.14.0 and 15.104.0 allows unauthenticated remote attackers to bypass access controls and retrieve restricted Doctype data through API endpoints, resulting in information disclosure of sensitive application data. The vulnerability is tagged as an authentication bypass with a CVSS 6.9 score and exploits missing authorization checks on API methods.
Stored cross-site scripting (XSS) in Frappe Learning Management System versions 2.27.0 through 2.47.x allows unauthenticated remote attackers to inject and persist malicious scripts that execute in the browsers of other users. The vulnerability affects content structure functionality and has been patched in version 2.48.0. No public exploit code or active exploitation has been confirmed at time of analysis.
Frappe is a full-stack web application framework. versions up to 14.100.2 is affected by cross-site scripting (xss).
Frappe is a full-stack web application framework. versions up to 14.100.1 is affected by server-side request forgery (ssrf) (CVSS 5.0).
Frappe versions prior to 14.100.1 and 15.100.0 contain a SQL injection vulnerability in an endpoint that allows authenticated attackers to extract sensitive information from the database. An attacker with valid credentials can craft malicious requests to bypass query protections and access confidential data without modifying or disrupting system availability. No patch is currently available for affected deployments.
Stored cross-site scripting in Frappe versions prior to 16.11.0 and 15.102.0 allows unauthenticated attackers to execute arbitrary JavaScript in users' browsers through malicious image URLs in avatar fields and website comments. The vulnerability affects any user viewing a page containing the compromised avatar, enabling session hijacking, credential theft, or malware distribution without user interaction.
Frappe Learning Management System versions 2.44.0 and below allow unauthenticated attackers to retrieve sensitive details about unpublished courses through API endpoints, exposing course content that should remain restricted. This information disclosure vulnerability affects all users of the affected versions, with no patch currently available pending the 2.45.0 release.
Frappe Learning Management System versions prior to 2.44.0 contain an information disclosure vulnerability that allows unauthenticated attackers to enumerate enrolled student email addresses from course batches. The flaw stems from improper access controls (CWE-863) that fail to restrict visibility of sensitive enrollment data to authorized users only. An attacker can exploit this over the network without authentication to obtain a complete roster of student contact information.
Malicious signup URLs in Frappe versions prior to 14.99.14 and 15.94.0 can redirect users to attacker-controlled sites or execute reflected XSS payloads during the registration process. An attacker can craft a crafted signup link to trick users into visiting malicious destinations or having malicious scripts executed in their browsers. A patch is available in the fixed versions.
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. [CVSS 4.1 MEDIUM]
A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. [CVSS 5.4 MEDIUM]
Frappe Learning Management System versions 2.44.0 and earlier contain a stored cross-site scripting (XSS) vulnerability in image filename handling that allows authenticated users to inject malicious JavaScript executed when course or job pages are viewed. An attacker with user privileges can craft specially designed image filenames to compromise other users' sessions and steal sensitive information. A patch is available to remediate this vulnerability.
Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. [CVSS 7.5 HIGH]
Authenticated server-side template injection in Frappe Framework (v14 branch before 14.99.6 and v15 branch before 15.88.1) allows an attacker to have a malicious template executed on the server, resulting in remote code execution with high confidentiality, integrity, and availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) shows two real gates: the attacker needs valid credentials at a non-trivial permission level and must socially engineer that user into opening a crafted link, so risk concentrates on targeted phishing of privileged accounts rather than opportunistic mass exploitation. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.50% (41st percentile); vendor-released patches 14.99.6 and 15.88.1 are available and the advisory states no workarounds exist.
Stored cross-site scripting in Frappe CRM allows an authenticated user with permission to create or edit a CRM Organization or Contact record to inject a crafted URL into the website field, which is later executed when another user clicks the link. This affects versions prior to 1.56.2 and requires victim interaction, confirmed by the CVSS vector (PR:L/UI:R). CISA KEV does not list this issue, and no public exploit code has been identified at time of analysis; the vendor has released version 1.56.2 as a patch.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on it) lets attackers upload a crafted XML/SVG file through the Attachments module that runs attacker-controlled script when a victim views it. Tagged as XSS/RCE/File Upload with a publicly available exploit code, though EPSS remains low at 0.44% (35th percentile) and it is not on CISA KEV. The CVSS 9.6 rating reflects a scope-changing, user-interaction-dependent attack rather than direct server-side compromise.
Authenticated SQL injection in Frappe ERPNext through 15.89.0 allows low-privilege users to extract arbitrary database contents via the to_posting_date parameter in get_outstanding_reference_documents(). Publicly available exploit code exists, though no active exploitation is confirmed (CISA KEV not indicated). The flaw requires authentication (PR:L) but no special configuration, making it a significant risk for multi-tenant or internet-facing deployments where low-privilege accounts are common.
SQL injection in Frappe ERPNext through 15.89.0 lets an authenticated attacker with a valid session and access to the Payment Entry/Accounts outstanding-reference lookup extract arbitrary database data by supplying a crafted from_posting_date value to get_outstanding_reference_documents(). Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. Independent assessment rates the confidentiality impact as high with low integrity and no availability impact, making this a genuine actionable priority despite the public proof of concept.
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 lets a user who can create or modify an Address Template inject arbitrary Jinja expressions that get_address_display later renders, yielding server-side code execution or database information disclosure. The root cause is that ERPNext's custom Jinja2 SandboxedEnvironment still exposes dangerous callables such as frappe.db.sql through get_safe_globals(), and the issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, and although exploitation requires an authenticated account holding the administrative-level Address Template write permission plus the ability to create an Address document with a matching country and call get_address_display with address_dict set to that document's name, the resulting impact on confidentiality, integrity, and availability is high.
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL queries via the get_dashboard_data endpoint. Unsafe concatenation of user-controlled parameters into dynamic SQL statements enables data exfiltration and database manipulation. Publicly available exploit code exists. With CVSS 8.6 (Network/Low Complexity/Low Privilege Required), this represents a high-severity risk for organizations running the affected version, though no active exploitation (CISA KEV) has been confirmed.
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.
Missing authorization enforcement in certain Frappe ERPNext endpoints allows an authenticated user holding only low-privilege role access to modify documents and records beyond the permissions assigned to their role, affecting all releases before 15.121.1 and 16.x before 16.34.2. Exploitation requires valid ERPNext credentials and the ability to reach the affected endpoints, but no user interaction and no non-default configuration - the flaw lies in the endpoints' own failure to check roles (CWE-862). Impact is bounded to low confidentiality and low integrity effects with no availability impact, no public exploit code has been identified at time of analysis, and the vendor has released patched versions (see advisory GHSA-49wp-r82c-j825).
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 allow authenticated users to modify data beyond their permitted role, compromising data integrity with no confidentiality or availability impact. Exploitation requires a valid low-privilege ERPNext account (PR:L) and reachable endpoints that fail to enforce role-based authorization; anonymous access is not possible, and no public exploit identified at time of analysis. This is a moderate-severity broken access control issue, not a critical flaw.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 let authenticated users with low-privilege roles modify data beyond their assigned permissions through certain network-reachable endpoints. According to the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), exploitation requires a valid authenticated session and results only in limited integrity impact, with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the vendor has released fixed versions 15.121.0 and 16.34.0.
Server-side request forgery and local file inclusion in Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 allow an authenticated user who can render user-controllable content to PDF to make the server fetch internal resources or embed local server files into the resulting PDF. The root cause is Frappe's dependency on a vulnerable version of the pdfkit library (CVE-2025-26240), which resolves external URLs and file references during server-side PDF rendering. The assessed vector is network-accessible but requires a valid Frappe account with access to a PDF-generating feature (print formats, templates, or report-to-PDF flows), and impact is limited to confidentiality; it is a medium-severity, low-priority issue for most deployments, and no public exploit was identified at time of analysis.
Stored cross-site scripting (XSS) in Frappe versions prior to 15.118.0 and 16.x before 16.31.0 allows authenticated attackers with dashboard chart editing privileges to inject malicious filter values that execute in the browsers of users who view the affected chart. The vulnerability arises because jQuery renders filter values as rich text instead of escaping them. Exploitation requires the victim to open the dashboard chart, and no public exploit code has been identified at time of analysis. This medium-severity issue (CVSS 5.1) can lead to session hijacking or other client-side attacks for the viewing user.
Disabled Frappe Framework user accounts can continue receiving Document Follow email notifications in versions before 15.118.0 and 16.x before 16.31.0, disclosing document activity to users whose access should have been revoked. Exploitation requires that the affected account previously followed one or more documents while active and was later disabled rather than deleted; it does not grant new document access or enable arbitrary external attackers to access documents. The independent assessment rates this as a missing-authorization information-disclosure flaw with low confidentiality impact (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:L/I:N/A:N); no public exploit identified at time of analysis.
Missing authorization checks in Frappe versions before 15.113.3 and 16.x before 16.25.0 allow authenticated users with low-privilege roles to modify records beyond their assigned permissions via crafted API requests to certain endpoints. Exploitation requires a valid authenticated session (PR:L) and impacts only integrity, with no confidentiality or availability impact. No public exploit has been identified at time of analysis, and the flaw is fixed in versions 15.113.3 and 16.25.0.
Missing authorization in Frappe Framework's whitelisted send_sms API endpoint allows any authenticated low-privilege user who lacks SMS-sending permissions to send arbitrary SMS messages that impersonate the Company, affecting releases before 15.120.0 and 16.x before 16.33.0. Exploitation requires a valid Frappe session (PR:L per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and no user interaction, but impact is confined to integrity/impersonation of outbound messaging with no data disclosure or service disruption, and is further gated by whether the instance has a functioning SMS gateway configured. No public exploit code was identified at time of analysis, and this is assessed as a medium/low-priority issue rather than a high-severity emergency.
Reflected cross-site scripting in Frappe ERPNext (all versions before 14.92.1, and 15.x before 15.83.0) lets an attacker inject arbitrary JavaScript that runs inside an authenticated user's session, enabling session/account takeover. The attacker needs no credentials (PR:N in the CVSS vectors), but exploitation requires a logged-in victim to follow a crafted URL (UI:P), so it is delivered by phishing or social engineering rather than by a direct server-side attack. Impact is rated high for confidentiality and integrity (VC:H/VI:H) with scope change under the CVSS 4.0 vector (8.6) and CVSS 3.1 equivalent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N); there is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is lower priority than a zero-interaction network RCE.
LDAP injection (CWE-90) in Frappe Framework allows unauthenticated remote attackers to manipulate directory queries by injecting crafted LDAP filter syntax through unsanitized endpoint parameters, with an impact limited to information disclosure (VC:L, VI:N, VA:N). The flaw affects Frappe releases before 14.99.2 and 15.x releases before 15.86.0, and is rated 6.3 under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N); exploitability is conditional because the instance must have LDAP integration actively configured, which is the attack requirement reflected by AT:P. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting (CWE-79) in the Frappe framework's leaderboard page allows an authenticated user to persist a crafted display name whose payload executes in the browsers of other users who open the leaderboard, in all versions before 14.99.10 and 15.x before 15.91.1. Because the name is stored server-side and rendered on a shared page, the payload fires for every visitor without further attacker interaction, giving cross-site scripting in the context of the Frappe application's origin. Exploitation requires a valid account capable of setting its own user name (PR:L) plus a victim navigating to the leaderboard (UI:P); no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 4.0 base score of 5.1 (MEDIUM) reflects the limited direct confidentiality/integrity impact on the vulnerable system offset by scope change to the victim's browser session.
Authenticated Frappe CRM users can read linked-document details for records they are not permitted to view, because the API method crm.api.doc.get_linked_docs_of_document in versions 1.49.0 through 1.87.0 resolves leads, deals, comments, and users by name without applying Frappe's permission checks. By supplying the name of a document they cannot legitimately access, any logged-in account - even a low-trust or self-service one - can extract linked call-log phone numbers, deal organization names, and mention notification text. The flaw is a genuine but modest information-disclosure issue (CVSS 5.3), limited to read-only metadata with no write, modification, or denial-of-service impact; no public exploit was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Missing authorization in Frappe HR (hrms) lets any authenticated user - including ordinary employees with no HR role - zero out another employee's leave allocation by POSTing the target Leave Allocation record name to the whitelisted expire_allocation method, silently wiping that employee's remaining leave balance. The flaw affects all 14.x and 15.x releases through 15.64.3 and every build before 16.11.0, is exploitable in the default configuration with only a low-privileged session and no victim interaction, and is confined to data integrity (no confidentiality or availability impact). No public exploit identified at time of analysis, and a vendor-released patch (16.11.0) is available, so this is best treated as a medium-severity, insider-oriented data-integrity issue rather than a mass-exploitation emergency.
Authenticated users of Frappe HR (hrms) - including accounts holding no HR role whatsoever - can read other employees' net pay along with loan, advance, and expense-claim balances by calling the whitelisted get_account_and_amount method over /api/method. Affected releases are all 14.x and 15.x builds through 15.64.3, plus any pre-16.11.0 build; the endpoint ships whitelisted by default and requires no non-default configuration or user interaction, only a valid low-privileged session (CVSS 4.0 score 5.3, PR:L, confidentiality-only impact). Exploitation is a straightforward IDOR-style enumeration exercise because Salary Slip and claim document names are sequential and guessable, so an attacker can harvest amounts systematically; CISA KEV does not list this issue and no public exploit code has been confirmed, although a public technical writeup describing the payroll "amount oracle" is referenced in the advisory data, making the technique widely discoverable.
Missing authorization in Frappe Raven 2.0.0 through 3.0.0 lets an authenticated user with the Raven User role join Public workspaces that are configured as invite-only, because the can_only_join_via_invite setting is not enforced by the join_workspace API. The practical consequence is unauthorized persistent membership in those workspaces, allowing the attacker to read and post messages in the associated Public and Open channels, but not to reach private data or administrative functions. Exploitation requires a valid authenticated account and a target that is specifically a Public workspace with invite-only enabled; no public exploit code has been identified at time of analysis, and EPSS/KEV signals are absent, so this rates as a medium-severity, low-to-moderate real-world risk.
Authenticated attackers can read other employees' expense claims, shift requests, and attendance records in Frappe HR up to 16.15.0 by exploiting an incorrect authorization flaw in the get_expense_claims, get_shift_requests, and get_attendance_requests API endpoints. The vulnerability requires a valid low-privilege session but no special permissions, and the vendor has confirmed the issue is fixed. No public exploit identified at time of analysis; the impact is limited to information disclosure (CVSS 5.3, MEDIUM).
Authenticated users holding the ERPNext Accounts Manager role can invoke arbitrary non-whitelisted server-side Python methods and read back their return values in Frappe ERPNext versions before 16.34.1. The flaw lives in Financial Report Template handling: a Custom API row's calculation_formula is passed straight to frappe.call() without verifying that the dotted path resolves to a whitelisted, GET-permitting method, so an attacker with rights to create or edit such templates can point the formula at internal methods that were never meant to be remotely callable. The assessed impact is limited information disclosure and limited integrity impact (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; CVSS 4.0 5.3), exploitation requires a privileged non-default role, no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data indicates active exploitation. This is a genuine but modest-severity issue best treated as medium-low priority.
Stored XSS in Frappe's workspace link description feature (versions 15.11.0-16.32.0) allows any user holding the Workspace Manager role to inject arbitrary JavaScript into a public workspace card, which executes in the browser session of any desk user who opens the workspace and hovers over the card description. The attack path reaches higher-privileged users through shared public workspaces, enabling session token theft and impersonation via authenticated API requests as the victim. No released version carries the fix; the upstream correction exists only on the development branch per commit 9f65e5ceca71aae91dcfd9bb3c0904afd386a01a, leaving all 15.x and 16.x deployments exposed.
User enumeration via observable response discrepancy in Frappe's personal data download (GDPR) endpoint allows unauthenticated remote attackers to determine whether any email address corresponds to a registered account. The PersonalDataDownloadRequest handler in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py returned the user_name field and persisted the document to the database only for known users, producing structurally distinct responses that an attacker could compare to systematically harvest registered email addresses. No public exploit has been identified at time of analysis; vendor-released patches exist at versions 15.115.0 and 16.27.0.
Cross-Site Request Forgery in Frappe Framework 16.31.0 and earlier allows an unauthenticated attacker to forge workflow approval actions on behalf of any authenticated victim user, because the bulk_workflow_approval endpoint in frappe/model/workflow.py accepts state-mutating requests via safe HTTP methods (GET) in addition to POST. The attacker needs only to lure an authenticated user to a crafted page or link, causing their browser to silently submit an approval with the victim's session credentials. No released patched version is available at time of analysis; the upstream fix exists only as an unmerged PR and commit.
Missing authorization on the toggle_like and mark_as_seen endpoints in Frappe Framework 16.31.0 and earlier allows authenticated users to interact with documents and notes they lack read access to. Any valid session holder can call these whitelisted endpoints with arbitrary doctype and document name parameters, confirming resource existence and modifying _liked_by metadata or note-seen state without a permission check. No public exploit has been identified at time of analysis, but an upstream fix exists in pull request #39760 with no released patched version confirmed.
SQL injection in ERPNext's tax rule engine allows any authenticated low-privilege user to extract arbitrary database content. The get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py directly interpolated request-supplied posting_date and args dictionary values into raw SQL WHERE clauses via Python f-strings and .format() calls, bypassing all parameterization. Vendor-released patches exist as versions 15.109.0 and 16.20.0; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization in ERPNext's account creation function allows any authenticated low-privilege user to bypass the Account doctype's create permission gate and insert unauthorized chart-of-accounts entries, directly corrupting financial data integrity and audit trails. All ERPNext releases prior to v15.111.0 (v15 branch) and v16.22.0 (v16 branch) are affected, as confirmed by vendor security advisory GHSA-94v6-784v-24q5 and the published PR diff. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in ERPNext's Process Statement of Accounts module allows any authenticated low-privilege user to invoke the send_emails function and dispatch automated account statement emails to customers without holding the required role. Versions prior to 15.111.0 (v15 branch) and 16.22.0 (v16 branch) are affected across all ERPNext deployments using this accounts feature. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the vendor has released confirmed patches for both active version branches.
Stale permission enforcement in Frappe's Document Follow subsystem allows authenticated users whose document access has been revoked or downgraded to continue receiving document-level data via scheduled email notifications. Affecting all Frappe v15 releases prior to 15.112.0 and v16 releases prior to 16.23.0, the flaw arises because notification generation never re-evaluates whether recipients still hold current read permission on subscribed documents at dispatch time. No public exploit code exists and no active exploitation has been confirmed; the vendor-assigned CVSS 4.0 score of 2.3 accurately reflects the narrow exposure window and the prerequisite that access revocation must have already occurred before the notification job fires.
Field-level permissions bypass in Frappe framework allows authenticated users to read restricted DocType field values via the document follow timeline feature. Frappe deployments on the v16 branch prior to 16.23.0 and the v15 branch prior to 15.112.0 are affected, including ERPNext and other applications built on Frappe. An authenticated low-privileged user can access historical change values for fields protected by Frappe's permlevel system simply by viewing the document follow timeline - no public exploit has been identified and the vulnerability is not listed in CISA KEV.
Path traversal via the download_backups endpoint in Frappe framework exposes arbitrary server-side files to authenticated high-privilege users. Affected versions span the entire v15 branch prior to 15.109.0 and the v16 branch prior to 16.19.0 (CPE: cpe:2.3:a:frappe:frappe:*). An attacker holding administrator-level credentials can craft a traversal payload in the backup download request to read files outside the intended backup directory, achieving high confidentiality impact with no integrity or availability consequence. No public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized file attachment in Frappe, a Python/JavaScript full-stack web framework, allows any authenticated low-privilege user to attach files to arbitrary doctypes through file-handling API endpoints such as add_attachments, bypassing per-document write permission enforcement. Affected are all Frappe v15 releases prior to 15.110.0 and all v16 releases prior to 16.20.0. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network accessibility make exploitation straightforward for any valid account holder on a multi-tenant instance.
Frappe framework's check_safe_sql_query function fails to block SELECT INTO OUTFILE statements, allowing authenticated low-privileged users to write arbitrary files to the server filesystem on self-hosted MySQL deployments where the database user holds the MySQL FILE privilege. Affected branches are v15 prior to 15.108.0 and v16 prior to 16.18.3; fixes are released at both version targets. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, with a CVSS 4.0 base score of 2.3 reflecting the narrow, non-default exploitation conditions captured by AT:P.
User enumeration via the reset_password endpoint in Frappe framework exposes valid account usernames to unauthenticated remote attackers across all versions prior to 15.106.0 and 16.16.0. The flaw stems from observable response discrepancies (CWE-203) that allow systematic probing of registered accounts without any credentials. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the zero-barrier network access makes this a realistic reconnaissance primitive for credential stuffing or targeted phishing campaigns against Frappe-based deployments.
Missing authorization on the reportview endpoint in Frappe framework permits authenticated low-privileged users to access or manipulate report data beyond their permitted scope. Versions prior to 15.107.5 (v15 branch) and 16.18.2 (v16 branch) are affected, confirmed via GitHub Security Advisory GHSA-w8g7-j846-j248. No public exploit or CISA KEV listing exists at time of analysis; the CVSS 4.0 PR:L metric confirms exploitation is bounded by requiring a valid authenticated session.
Stored XSS in Frappe Framework 17.0.0-dev allows authenticated low-privileged users to inject persistent malicious scripts via the frappe.ui.Tree component, which then execute in the browsers of other users who load the affected tree view. Reported by Fluid Attacks, this vulnerability carries a CVSS 4.0 score of 4.8 reflecting cross-user scope change impact despite limited direct system compromise. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows a high-privileged authenticated user to inject persistent malicious scripts into the Number Card dashboard component, which then execute in the browsers of other users who view the affected dashboard. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation requires admin-level access to plant the payload and a victim's browser interaction to trigger it, limiting realistic blast radius despite the network delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in Frappe Framework version 17.0.0-dev allows a high-privileged authenticated user to inject malicious JavaScript through the Number Card dashboard component, which subsequently executes in other authenticated users' browser sessions when they view affected dashboards. The CVSS 4.0 score of 4.6 (Medium) reflects the dual constraint of requiring high-privilege credentials to plant the payload and active victim interaction to trigger it - both of which meaningfully limit real-world exploitability. No public exploit code or CISA KEV listing is identified at time of analysis; this was reported by Fluid Attacks.
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated low-privileged user to inject persistent JavaScript payloads via the Notifications > Events panel, which execute in the browser context of any user who subsequently views that panel. The CVSS 4.0 vector confirms subsequent-system scope impact (SC:L/SI:L), meaning the attack targets other users rather than the attacker's own session. No public exploit has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored XSS in Frappe Framework 17.0.0-dev's MultiSelectDialog component allows authenticated low-privileged attackers to inject persistent malicious scripts that execute in other users' browsers when the compromised UI element is rendered. Per the CVSS 4.0 vector (PR:L/UI:A/SC:L/SI:L), exploitation requires a valid low-privilege account and active victim interaction, but the scope change to the subsequent system confirms cross-user impact on confidentiality and integrity. No public exploit code and no CISA KEV listing exist at time of analysis; the 17.0.0-dev designation suggests exposure may currently be limited to pre-release or development deployments.
Cross-site scripting in Frappe Framework 17.0.0-dev allows a high-privileged attacker who can modify the Form Dashboard headline to inject malicious JavaScript that executes in the browsers of other users who subsequently view the affected form. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation is gated behind two significant barriers: attacker must hold high-privilege application credentials and a victim must actively navigate to the injected form. No public exploit code and no active exploitation (CISA KEV) have been identified at the time of analysis; this was reported by Fluid Attacks.
Stored XSS in Frappe Framework 17.0.0-dev allows a high-privileged attacker to inject persistent malicious scripts into the File View breadcrumb renderer, which then execute in the browsers of other users who navigate to the affected view. The CVSS 4.0 vector (PR:H, UI:A, SC:L/SI:L) confirms that while network delivery is possible, exploitation is constrained by the need for elevated access to inject the payload and victim interaction to trigger it, with impact limited to the subsequent system (victim browser). No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated low-privileged user to inject persistent malicious scripts via the Desk desktop icon renderer, which then execute in the browsers of other users - including administrators - who subsequently view the affected Desk interface. The vulnerability was reported by Fluid Attacks and carries a CVSS 4.0 score of 4.8 (Medium), reflecting cross-user impact limited to the subsequent-system scope (SC:L/SI:L). No public exploit code or active exploitation has been identified at time of analysis.
Reflected Cross-Site Scripting in Frappe Framework 17.0.0-dev's dashboard-view component allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms no authentication is required from the attacker, though victim interaction is mandatory. Impact is confined to the subsequent system (victim browser session), with low integrity and confidentiality consequences; no active exploitation or public POC has been identified at time of analysis.
Stored XSS in Frappe Framework 17.0.0-dev allows high-privileged authenticated attackers to inject persistent malicious scripts via the `frappe.get_avatar` function, which execute in victims' browsers when the crafted content is rendered. The CVSS 4.0 score of 4.6 (Medium) reflects the PR:H requirement to store the payload and UI:A requirement for victim interaction, with impact limited to subsequent systems (other users' sessions). No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated attacker with write access to the Auto Repeat module to inject persistent HTML/JavaScript into the reference_document field via a whitelisted write path, bypassing server-side input controls. When any user opens the affected Auto Repeat form, the injected payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized UI manipulation on behalf of the victim. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; however, the stored (persistent) nature of this XSS makes it more dangerous than reflected variants within shared Frappe deployments.
Stored XSS in Frappe Framework 17.0.0-dev allows a high-privileged authenticated attacker to inject persistent malicious scripts into the Audit Trail component, which then execute in the browsers of other privileged users who view that trail. The vulnerability arises from improper input neutralization (CWE-79) before HTML rendering in the audit logging subsystem, and is assigned a CVSS 4.0 score of 4.6 reflecting the high-privilege prerequisite and required victim interaction. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Stored XSS in Frappe's Report and List View components allows injection of persistent JavaScript payloads that execute in the browsers of any user who subsequently accesses the affected views. All Frappe deployments on the v15 branch prior to 15.107.2 and v16 branch prior to 16.17.4 are affected per the GitHub security advisory GHSA-rx63-c3fh-8926. No public exploit has been identified at time of analysis and the EPSS score of 0.02% (7th percentile) reflects low current exploitation probability, though the network-accessible nature of Frappe instances keeps this relevant for organizations running unpatched versions.
Missing authorization checks on multiple Frappe framework endpoints allow remote unauthenticated attackers to access and modify resources without permission. All Frappe installations on the 15.x branch prior to 15.107.0 and the 16.x branch prior to 16.17.0 are affected. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% reflects minimal current exploitation activity, though the attack requires no credentials or special preconditions.
Improper access control in Frappe Framework (all versions prior to 16.17.4) allows any authenticated user to retrieve private files by guessing their server-side file path, bypassing intended authorization restrictions. The flaw is classified under CWE-284 (Improper Access Control) and affects the file-serving layer of the framework, which underlies widely deployed applications such as ERPNext. No public exploit code has been identified at time of analysis, and exploitation probability is very low per EPSS (0.02%, 7th percentile), though the low attack complexity makes it straightforward for any credentialed user to attempt.
Improper access control in Frappe prior to 16.17.4 permits any authenticated user to modify any field in any Onboarding Step record, bypassing expected privilege restrictions. Affected deployments running versions below 16.17.4 expose their onboarding configuration data to unauthorized tampering by low-privileged users. EPSS is extremely low (0.02%, 5th percentile), no public exploit code has been identified, and the vulnerability is not listed in CISA KEV, suggesting no observed active exploitation at time of analysis.
Missing authorization in Frappe allows any authenticated low-privileged user to invoke the onboarding reset function and wipe onboarding state for all users system-wide, affecting all releases before 15.107.2 and 16.17.4. The CWE-862 root cause indicates the reset endpoint performs no role or privilege check before executing a privileged, system-wide operation. No public exploit code exists and EPSS sits at 0.02% (5th percentile), placing real-world exploitation risk at the lower end despite the disruptive potential of forcing every user through onboarding flows on next login.
DB schema enumeration in Frappe (versions prior to 15.107.2 and 16.17.4) exposes internal database structure to unauthenticated remote attackers via a vulnerable endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, making this accessible to any internet-facing instance. While limited to low confidentiality impact (VC:L) with no integrity or availability consequences, schema information can inform targeted follow-on attacks against the application's data layer. No public exploit has been identified at time of analysis, and EPSS of 0.02% (7th percentile) indicates low current exploitation probability.
Insecure Direct Object Reference (IDOR) in the Frappe full-stack web application framework exposes email configuration details of arbitrary users to any authenticated account. The flaw exists in versions prior to 15.107.0 (v15 branch) and 16.17.0 (v16 branch), allowing a low-privilege authenticated attacker to enumerate and read email settings belonging to other users by manipulating object references in requests. No public exploit has been identified and the issue is not listed in CISA KEV, though the low EPSS score (0.02%) and network-accessible vector warrant patching, particularly for multi-tenant Frappe deployments.
Unauthorized resource access in the Frappe web application framework exposes the submit_discussion() endpoint to unauthenticated network callers who can bypass access controls and write discussion data to resources they do not own. All Frappe deployments running versions prior to 15.107.0 (v15 branch) or 16.17.0 (v16 branch) are affected, with impact limited to low-severity integrity writes and no confidentiality or availability consequence. No public exploit code exists and EPSS probability is 0.03% (9th percentile), indicating low opportunistic exploitation pressure despite the unauthenticated network attack vector.
Stored cross-site scripting in Frappe's user profile image section enables script injection that executes in the browsers of any user who views the compromised profile. Affected versions are all Frappe releases prior to 15.106.0. No public exploit code or CISA KEV listing exists at time of analysis; EPSS of 0.02% (7th percentile) reflects low observed exploitation activity, though stored XSS in a shared framework carries inherent persistence risk across all applications built on Frappe.
SQL Injection in the Frappe full-stack web framework's get_blog_list function allows unauthenticated remote attackers to manipulate database queries, leading to limited data read and write access. Frappe versions prior to 15.106.0 (v15 branch) and 16.16.0 (v16 branch) are affected across all deployments that expose the blog module. No public exploit code has been identified and exploitation probability is very low per EPSS (0.02%), though the network-accessible, unauthenticated attack surface warrants prompt patching for internet-facing instances.
Stored cross-site scripting in the Frappe framework's Note feature allows a low-privileged attacker to persist malicious JavaScript that executes in the browsers of users who subsequently view the poisoned note. All Frappe deployments on the v15 branch prior to 15.106.0 and the v16 branch prior to 16.16.0 are affected. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed patches are available and should be applied promptly given the ease of exploitation once an attacker holds any valid user account.
Metadata injection in Frappe LMS prior to version 2.53.0 enables authenticated users to embed crafted content into user-editable fields that, when reflected in page metadata, silently redirects visiting users' browsers to an attacker-controlled URL. Exploitation requires a low-privilege account (PR:L) and passive victim interaction (UI:P) - a target must visit a page containing the poisoned content. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; its CVSS 4.0 score of 2.1 reflects genuinely low severity, though the redirect capability carries downstream phishing and credential-harvesting risk.
Stored cross-site scripting in ERPNext 16.16.0 allows an authenticated user holding Item record edit permissions to persist malicious HTML/JavaScript in the item_name, description, or image fields, which executes unescaped in the Point of Sale (POS) cart interface for any operator who subsequently adds that item to a transaction. Reported by Fluid Attacks (EUVD-2026-34158), this is a stored XSS with lateral impact across all POS operator sessions exposed to the poisoned item record. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 4.8 reflects the constrained attack surface imposed by high privilege prerequisites and required passive user interaction.
Stored cross-site scripting in ERPNext 16.16.0 allows authenticated users to inject arbitrary HTML and JavaScript into the email_id or mobile_no fields of Customer records, which execute silently in the browser of every Point of Sale (POS) operator who subsequently selects the poisoned customer. Because the payload persists in the database, a single injection event affects all future POS operator sessions that encounter that customer - creating a multiplier effect without requiring repeated attacker access. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided in available intelligence sources.
Insufficient authorization enforcement on specific ERPNext endpoints allows authenticated low-privilege users to read sensitive data beyond their permitted role and make limited unauthorized data modifications. Affecting all ERPNext deployments prior to 15.102.0 (v15 branch) and prior to 16.11.0 (v16 branch), an attacker holding any valid user account can invoke unprotected server-side endpoints to access restricted records or alter data outside their role scope. No public exploit code exists and SSVC confirms no active exploitation, but the high confidentiality impact (CVSS C:H) warrants prompt patching - particularly on internet-exposed ERPNext instances where low-privilege accounts may be broadly distributed.
XML External Entity (XXE) injection in ERPNext's EDI Module allows authenticated low-privilege attackers to read arbitrary files from the server's local filesystem, including sensitive configuration files that may contain database credentials or API keys. Affected are all ERPNext installations on the v15 branch prior to 15.104.3 and on the v16 branch prior to 16.12.0 (cpe:2.3:a:frappe:erpnext:*). No public exploit identified at time of analysis, EPSS exploitation probability sits at 0.06% (18th percentile), and CISA SSVC assesses exploitation as none and the attack as non-automatable - collectively placing this at lower operational priority despite its network-accessible attack vector.
Server-Side Request Forgery (SSRF) in ERPNext allows an authenticated remote attacker to send a crafted request to a vulnerable endpoint, causing the ERPNext server to issue arbitrary outbound HTTP calls to attacker-controlled services. The CVSS Changed scope (S:C) indicates the impact extends beyond the application itself, enabling potential access to internal network resources, cloud metadata services, or other intranet endpoints not otherwise reachable by the attacker. Vendor-released patches exist in versions 15.106.0 and 16.16.0; no active exploitation has been confirmed (not listed in CISA KEV) and EPSS sits at a very low 0.02%.
Path traversal in ERPNext exposes arbitrary server files to authenticated low-privileged users via a vulnerable endpoint that fails to restrict directory access. Affected versions are ERPNext prior to 15.101.1 and the 16.x beta line prior to 16.10.0, packaged under CPE cpe:2.3:a:frappe:erpnext. An attacker with a valid account can craft a request to read sensitive files outside the intended directory scope, resulting in full confidentiality compromise of the host filesystem. No public exploit identified at time of analysis, and CISA SSVC signals no active exploitation.
Reflected cross-site scripting (XSS) in Frappe Press login page redirect parameter allows unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser upon clicking a malicious link, with user interaction required. The vulnerability affects all versions prior to the patch commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6, which restricts redirects to internal URLs only. CVSS score of 1.3 reflects very low confidentiality, integrity, and availability impact due to scope limitations, though XSS vulnerabilities carry inherent session hijacking and credential theft risks.
Frappe Press `create_api_secret` endpoint accepts GET requests despite performing database writes, enabling Cross-Site Request Forgery (CSRF)-like attacks where unauthenticated remote attackers can create API secrets by tricking authenticated users into visiting a malicious URL. No public exploit code or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting (XSS) in Frappe 16.10.0 allows authenticated attackers with high privileges to inject malicious scripts into document fields, which execute in the browser of any user who subsequently opens the affected document in Desk. The vulnerability stems from unsafe HTML interpolation in multiple formatter implementations that fail to escape user-supplied values, enabling persistent client-side code execution with limited scope (low integrity/availability impact). CVSS 4.6 reflects the requirement for authenticated high-privilege access and user interaction, but the XSS vector represents a significant persistence and social engineering risk in collaborative document environments.
Stored cross-site scripting (XSS) in Frappe 16.10.10 allows authenticated attackers with high privileges to inject malicious JavaScript via crafted tag values in the _user_tags field, which execute when victims open list or report views. The vulnerability stems from unescaped interpolation of tag content into HTML attributes and element content. Exploitation requires user interaction (victim must open affected view) and high-level authentication, but results in session hijacking or data theft with partial technical impact; CISA SSVC framework rates this as exploitable via proof-of-concept with partial technical impact.
SQL injection in Frappe HR (HRMS) exposes sensitive human resources data to authenticated remote attackers via a specially crafted request to an undisclosed endpoint. Affected installations running versions prior to 15.54.0 (v15 branch) or 14.38.1 (v14 branch) are vulnerable to unauthorized data extraction through unsanitized query parameters. No public exploit code has been identified and CISA KEV does not list this CVE; EPSS at 0.03% (10th percentile) and SSVC exploitation status of 'none' collectively indicate low current threat actor interest, though the C:H CVSS impact reflects meaningful data exposure risk for organizations handling employee records.
Unauthorized file access in Frappe HRMS allows any authenticated user to retrieve files attached to documents they are not permitted to view by calling the attachment API endpoint without proper authorization enforcement. Affected versions span both the v15 branch (prior to 15.58.2) and v16 branch (prior to 16.4.2); patched releases are available from the vendor. No public exploit exists and EPSS is 0.03% (8th percentile), though the confidentiality impact is significant given that HR systems routinely store payroll records, employment contracts, and personal employee data.
Unauthorized employee data disclosure in Frappe HRMS allows any authenticated user holding only a default role to retrieve private employee fields via an insufficiently access-controlled API endpoint in the Roster shift assignment module. Affected versions span the v15 branch prior to 15.58.1 and the v16 branch prior to 16.4.1. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile), and CISA SSVC rates exploitation as none with partial technical impact.
Frappe Learning Management System versions prior to 2.46.0 allow authenticated students to modify their own quiz scores via client-side manipulation using browser developer tools before submission. This vulnerability compromises the integrity of quiz results and academic reliability without enabling privilege escalation, unauthorized account access, or exposure of confidential information. The fix is available in version 2.46.0, and no public exploit code or active exploitation has been identified at the time of analysis.
Frappe web application framework prior to versions 16.14.0 and 15.104.0 allows unauthenticated remote attackers to bypass access controls and retrieve restricted Doctype data through API endpoints, resulting in information disclosure of sensitive application data. The vulnerability is tagged as an authentication bypass with a CVSS 6.9 score and exploits missing authorization checks on API methods.
Stored cross-site scripting (XSS) in Frappe Learning Management System versions 2.27.0 through 2.47.x allows unauthenticated remote attackers to inject and persist malicious scripts that execute in the browsers of other users. The vulnerability affects content structure functionality and has been patched in version 2.48.0. No public exploit code or active exploitation has been confirmed at time of analysis.
Frappe is a full-stack web application framework. versions up to 14.100.2 is affected by cross-site scripting (xss).
Frappe is a full-stack web application framework. versions up to 14.100.1 is affected by server-side request forgery (ssrf) (CVSS 5.0).
Frappe versions prior to 14.100.1 and 15.100.0 contain a SQL injection vulnerability in an endpoint that allows authenticated attackers to extract sensitive information from the database. An attacker with valid credentials can craft malicious requests to bypass query protections and access confidential data without modifying or disrupting system availability. No patch is currently available for affected deployments.
Stored cross-site scripting in Frappe versions prior to 16.11.0 and 15.102.0 allows unauthenticated attackers to execute arbitrary JavaScript in users' browsers through malicious image URLs in avatar fields and website comments. The vulnerability affects any user viewing a page containing the compromised avatar, enabling session hijacking, credential theft, or malware distribution without user interaction.
Frappe Learning Management System versions 2.44.0 and below allow unauthenticated attackers to retrieve sensitive details about unpublished courses through API endpoints, exposing course content that should remain restricted. This information disclosure vulnerability affects all users of the affected versions, with no patch currently available pending the 2.45.0 release.
Frappe Learning Management System versions prior to 2.44.0 contain an information disclosure vulnerability that allows unauthenticated attackers to enumerate enrolled student email addresses from course batches. The flaw stems from improper access controls (CWE-863) that fail to restrict visibility of sensitive enrollment data to authorized users only. An attacker can exploit this over the network without authentication to obtain a complete roster of student contact information.
Malicious signup URLs in Frappe versions prior to 14.99.14 and 15.94.0 can redirect users to attacker-controlled sites or execute reflected XSS payloads during the registration process. An attacker can craft a crafted signup link to trick users into visiting malicious destinations or having malicious scripts executed in their browsers. A patch is available in the fixed versions.
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. [CVSS 4.1 MEDIUM]
A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. [CVSS 5.4 MEDIUM]
Frappe Learning Management System versions 2.44.0 and earlier contain a stored cross-site scripting (XSS) vulnerability in image filename handling that allows authenticated users to inject malicious JavaScript executed when course or job pages are viewed. An attacker with user privileges can craft specially designed image filenames to compromise other users' sessions and steal sensitive information. A patch is available to remediate this vulnerability.
Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. [CVSS 7.5 HIGH]
Authenticated server-side template injection in Frappe Framework (v14 branch before 14.99.6 and v15 branch before 15.88.1) allows an attacker to have a malicious template executed on the server, resulting in remote code execution with high confidentiality, integrity, and availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) shows two real gates: the attacker needs valid credentials at a non-trivial permission level and must socially engineer that user into opening a crafted link, so risk concentrates on targeted phishing of privileged accounts rather than opportunistic mass exploitation. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.50% (41st percentile); vendor-released patches 14.99.6 and 15.88.1 are available and the advisory states no workarounds exist.
Stored cross-site scripting in Frappe CRM allows an authenticated user with permission to create or edit a CRM Organization or Contact record to inject a crafted URL into the website field, which is later executed when another user clicks the link. This affects versions prior to 1.56.2 and requires victim interaction, confirmed by the CVSS vector (PR:L/UI:R). CISA KEV does not list this issue, and no public exploit code has been identified at time of analysis; the vendor has released version 1.56.2 as a patch.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on it) lets attackers upload a crafted XML/SVG file through the Attachments module that runs attacker-controlled script when a victim views it. Tagged as XSS/RCE/File Upload with a publicly available exploit code, though EPSS remains low at 0.44% (35th percentile) and it is not on CISA KEV. The CVSS 9.6 rating reflects a scope-changing, user-interaction-dependent attack rather than direct server-side compromise.
Authenticated SQL injection in Frappe ERPNext through 15.89.0 allows low-privilege users to extract arbitrary database contents via the to_posting_date parameter in get_outstanding_reference_documents(). Publicly available exploit code exists, though no active exploitation is confirmed (CISA KEV not indicated). The flaw requires authentication (PR:L) but no special configuration, making it a significant risk for multi-tenant or internet-facing deployments where low-privilege accounts are common.
SQL injection in Frappe ERPNext through 15.89.0 lets an authenticated attacker with a valid session and access to the Payment Entry/Accounts outstanding-reference lookup extract arbitrary database data by supplying a crafted from_posting_date value to get_outstanding_reference_documents(). Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. Independent assessment rates the confidentiality impact as high with low integrity and no availability impact, making this a genuine actionable priority despite the public proof of concept.
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 lets a user who can create or modify an Address Template inject arbitrary Jinja expressions that get_address_display later renders, yielding server-side code execution or database information disclosure. The root cause is that ERPNext's custom Jinja2 SandboxedEnvironment still exposes dangerous callables such as frappe.db.sql through get_safe_globals(), and the issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, and although exploitation requires an authenticated account holding the administrative-level Address Template write permission plus the ability to create an Address document with a matching country and call get_address_display with address_dict set to that document's name, the resulting impact on confidentiality, integrity, and availability is high.
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL queries via the get_dashboard_data endpoint. Unsafe concatenation of user-controlled parameters into dynamic SQL statements enables data exfiltration and database manipulation. Publicly available exploit code exists. With CVSS 8.6 (Network/Low Complexity/Low Privilege Required), this represents a high-severity risk for organizations running the affected version, though no active exploitation (CISA KEV) has been confirmed.
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.