CVE-2026-47765

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulkrestore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in...

CVE-2026-47185

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...

CVE-2026-47194

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token...

CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391

CVE-2026-49391 affects Frappe framework’s Data Import feature. Before versions 16.19.0 and 15.109.0, imported column headers were not escaped when rendering previews/results, enabling an authenticated user to persist script content that executes when another user views the import interface (Store...

CVE-2026-47765 Frappe: Lack of Permissions in restore/bulk_restore

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulkrestore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in...

CVE-2026-47765

CVE-2026-47765 (Frappe) : A permissions check gap exists in the restore and bulk_restore endpoints of Frappe prior to versions 15.110.0 and 16.20.0, allowing an authenticated user to restore deleted documents without proper authorization. The issue is fixed in those respective versions. Impact is...

CVE-2026-47765 Frappe: Lack of Permissions in restore/bulk_restore

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulkrestore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in...

CVE-2026-47194 Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token...

CVE-2026-47194 Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token...

CVE-2026-47194

CVE-2026-47194 affects Frappe, a full-stack web framework. Before versions 15.108.0 and 16.18.3, the temporary magic login link generation could be influenced by an attacker-controlled Host header, allowing a remote attacker to make emailed login links point to a domain they control and capture t...

CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...

CVE-2026-47185

CVE-2026-47185 — Frappe Workspace Save API : In Frappe, prior to version 16.18.0, the Workspace Save API accepted a controlled workspace identifier from any authenticated user without enforcing workspace ownership, enabling modification of another user’s private workspace and risking persistent s...

CVE-2026-12895

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

CVE-2026-12895 SQL Injection in Frappe's ERPNext

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

CVE-2026-12895

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

EUVD-2026-50294

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

CVE-2026-12895

CVE-2026-12895 affects ERPNext 15.107.0 and Frappe 15.107.2. The flaw arises from constructing SQL queries via direct string interpolation (str.format()) instead of parameterized queries, allowing an authenticated user with low privileges to inject SQL through a Supplier record name (docname). Ex...

CVE-2026-39385

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...