Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above. id: CVE-2026-39352 info: name: Frappe Framework 16.15.0 - Arbitrary File...

CVE-2025-56379

CVE-2025-56379 — ERPNext 15.67.0 / Frappe 15.72.4 में संग्रहीत क्रॉस-साइट स्क्रिप्टिंग XSS 📌 सारांश ERPNext v15.67.0 / Frappe v15.72.4 के ब्लॉग मॉड्यूल में एक संग्रहीत क्रॉस-साइट स्क्रिप्टिंग XSS भेद्यता मौजूद है। एक प्रमाणित उपयोगकर्ता जो ब्लॉग पोस्ट बना या संपादित कर सकता है, content फ़ील्ड में...

CVE-2025-56380

CVE-2025-56380 — Injeção SQL cega baseada em tempo no Frappe / ERPNext frappe.client.getvalue 📌 Resumo Uma vulnerabilidade de injeção SQL cega baseada em tempo foi descoberta no endpoint da API frappe.client.getvalue no Frappe Framework v15.72.4 e presente no código do ERPNext v15.67.0. Um usuári...

CVE-2026-66001

Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in...

CVE-2026-66002

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and...

CVE-2026-63654

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulkworkflowapproval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...

CVE-2026-66002

Frappe , a full-stack web application framework, is vulnerable to user enumeration via its public request-data web form and PersonalDataDownloadRequest class. The endpoint returns distinguishable response shapes for registered versus unregistered email addresses, including the user_name field and...

CVE-2026-66002 Frappe: User Enumeration via PDDR

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and...

CVE-2026-66002 Frappe: User Enumeration via PDDR

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and...

EUVD-2026-63541

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and...

CVE-2026-66001 Frappe: Improper Authorization in OAuth2 Consent Endpoint

Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in...

EUVD-2026-63540

Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in...

CVE-2026-66001

Frappe , a full-stack web application framework, contains an improper authorization flaw in its OAuth2 consent flow (frappe/integrations/oauth2.py). The approve and authorize functions lacked three critical controls: the approve action was not restricted to POST , the consent template (oauth_conf...

CVE-2026-66001 Frappe: Improper Authorization in OAuth2 Consent Endpoint

Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in...

CVE-2026-62315

Frappe (full-stack web application framework) is affected by a type confusion vulnerability in frappe.client.set_value (frappe/client.py) in version 16.31.0 and earlier . The function validates a dictionary supplied via the fieldname parameter against forbidden standard and child-table fields bef...

CVE-2026-62315 Frappe: Mass assignment via set_value

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

CVE-2026-62315 Frappe: Mass assignment via set_value

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

EUVD-2026-63539

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

CVE-2026-63654 Frappe: Unauthenticated Workflow approval via confirm_action

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulkworkflowapproval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...

CVE-2026-63654

Frappe (full-stack web application framework) versions 16.31.0 and earlier contain a vulnerability in the frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py. The whitelisted endpoint is not restricted to POST , meaning it accepts safe HTTP methods (e.g., GET) for st...