532 matches found
CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...
CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...
Frappe Cross-Site Scripting Vulnerability
Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A cross-site scripting vulnerability exists in Frappe versions prior to 14.59.0, 15.5.0 and 15.5.0, which stems from a cross-site scripting vulnerabilit...
Frappe Technologies Frappe Cross-Site Scripting Vulnerability
Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe prior to version 14.49.0, which can be exploited by a malicious Frappe user with desktop...
CVE-2023-41328
Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to...
CVE-2023-41328 Possibility limited SQL injection due to insufficient validation in Frappe
Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to...
Frappe Technologies Frappe SQL Injection Vulnerability
Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. Frappe suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to access sensitive information...
CVE-2023-41328: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to...
PT-2023-27906 · Frappe · Frappe
Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 13.46.1 Frappe versions prior to 14.20.0 Description: A SQL Injection issue has been identified in the Frappe Framework, which could allow a malicious actor to access sensitive information. Recommendations: For versio...
Frappe Framework 13.4.0 Remote Code Execution
Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Date: 2023-06-07 Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frap...
Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)
Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Date: 2023-06-07 Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frap...
Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated) Vulnerability
Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frappe Framework uses...
Malicious Package
Overview frappe-framework is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...
Malicious code in frappe-framework (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fd4c91421f9d8f397b84256da7d774eaa4de780d5790b0b17a27315cc7c8479 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-460 Malicious code in frappe-framework (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fd4c91421f9d8f397b84256da7d774eaa4de780d5790b0b17a27315cc7c8479 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Frappe Technologies Frappe 路径遍历漏洞
Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe version 14.10.0, which stems from a failure to properly validate user-injected information...
Frappe Technologies Frappe 跨站脚本漏洞
Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe prior to version 2.5.0, which stems from unknown functionality in the component Search in...
CVE-2020-35175
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...
