Frappe Technologies Frappe Framework SQL注入漏洞

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. Frappe Technologies Frappe Framework versions prior to 14.89.0 and 15.51.0 are vulnerable to a SQL injection vulnerability that originates...

PT-2025-12807

Name of the Vulnerable Software and Affected Versions Frappe Framework versions prior to 14.89.0 Frappe Framework versions prior to 15.51.0 Description A security issue has been identified in the Frappe Framework, which is a full-stack web application framework. The issue is related to SQL...

Frappe Technologies Frappe Framework 信息泄露漏洞

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. An information disclosure vulnerability exists in Frappe Technologies Frappe Framework versions prior to 14.89.0 and 15.51.0, which stems...

Frappe Technologies Frappe Framework 输入验证错误漏洞

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. An input validation error vulnerability exists in Frappe Technologies Frappe Framework versions prior to 14.91.0 and 15.52.0, which stems...

CVE-2024-24813

Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access to data which the user doesn't have permission to access. Versions 14.64.0 and 15.0.0 contain a patch for this issue. No known workaround...

Frappe Technologies Frappe 安全漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. Frappe Technologies Frappe has a security vulnerability that originates from allowing redirects to untrusted external URls, which can be phished by...

Frappe Technologies Frappe 安全漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe versions prior to 14.64.0 and prior to 15.0.0, which stems from an SQL injection...

CVE-2024-27105 Frappe File Permissions can by bypassed using certain endpoints

Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds...

CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...

CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...

Frappe Cross-Site Scripting Vulnerability

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A cross-site scripting vulnerability exists in Frappe versions prior to 14.59.0, 15.5.0 and 15.5.0, which stems from a cross-site scripting vulnerabilit...

Frappe Technologies Frappe Cross-Site Scripting Vulnerability

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe prior to version 14.49.0, which can be exploited by a malicious Frappe user with desktop...

CVE-2023-41328

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to...

CVE-2023-41328 Possibility limited SQL injection due to insufficient validation in Frappe

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to...

PT-2023-27906 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 13.46.1 Frappe versions prior to 14.20.0 Description: A SQL Injection issue has been identified in the Frappe Framework, which could allow a malicious actor to access sensitive information. Recommendations: For versio...

Frappe Technologies Frappe SQL Injection Vulnerability

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. Frappe suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to access sensitive information...

Frappe Framework 13.4.0 Remote Code Execution

Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Date: 2023-06-07 Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frap...

Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)

Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Date: 2023-06-07 Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frap...

Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated) Vulnerability

Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frappe Framework uses...

Malicious Package

Overview frappe-framework is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...