532 matches found
Sql injection
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection...
Sql injection
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection SSTI issue exists...
Design/Logic Flaw
An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability...
CVE-2019-14965
CVE-2019-14965 affects Frappe Framework versions 10–12 before 12.0.4 and is a server-side template injection (SSTI) vulnerability. The issue arises from an SSTI in the framework whose root cause and impact enable an attacker to execute code or access sensitive data on affected systems (impact det...
CVE-2019-14965
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection SSTI issue exists...
CVE-2019-14966
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection...
CVE-2019-14966
CVE-2019-14966 affects Frappe Framework versions 10 through 12 prior to 12.0.4, introducing an authenticated SQL injection vulnerability. The issue is addressed in 12.0.4 (and later); upgrade to 12.0.4+ to mitigate. The available connected documents confirm the vulnerability and the fixed release...
CVE-2019-14967
An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability...
CVE-2019-14967
Frappe Framework versions 10 and 11 before 11.1.46, and 12 contain an XSS vulnerability that can be exploited to execute client-side code. Remediation: upgrade to 11.1.46 or later (the fixed version referenced in linked advisories). If upgrading, verify that affected components are updated to a v...
CVE-2019-14965: Improper Control of Generation of Code
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection SSTI issue exists...
CVE-2019-14966: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection...
CVE-2019-14967: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability...