CVE-2025-30212 Frappe has possibility of SQL injection due to improper validations

Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no...

Frappe Technologies Frappe Framework 信息泄露漏洞

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. An information disclosure vulnerability exists in Frappe Technologies Frappe Framework versions prior to 14.89.0 and 15.51.0, which stems...

CVE-2025-30212: Improper Neutralization of Special Elements used in an SQL Command

Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no...

PT-2025-12807

Name of the Vulnerable Software and Affected Versions Frappe Framework versions prior to 14.89.0 Frappe Framework versions prior to 15.51.0 Description A security issue has been identified in the Frappe Framework, which is a full-stack web application framework. The issue is related to SQL...

Frappe Technologies Frappe Framework SQL注入漏洞

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. Frappe Technologies Frappe Framework versions prior to 14.89.0 and 15.51.0 are vulnerable to a SQL injection vulnerability that originates...

Frappe Technologies Frappe Framework 输入验证错误漏洞

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. An input validation error vulnerability exists in Frappe Technologies Frappe Framework versions prior to 14.91.0 and 15.52.0, which stems...

CVE-2024-24813

Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access to data which the user doesn't have permission to access. Versions 14.64.0 and 15.0.0 contain a patch for this issue. No known workaround...

Frappe Technologies Frappe 安全漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. Frappe Technologies Frappe has a security vulnerability that originates from allowing redirects to untrusted external URls, which can be phished by...

Frappe Technologies Frappe 安全漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe versions prior to 14.64.0 and prior to 15.0.0, which stems from an SQL injection...

CVE-2024-27105 Frappe File Permissions can by bypassed using certain endpoints

Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds...

CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...

CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...

Frappe Cross-Site Scripting Vulnerability

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A cross-site scripting vulnerability exists in Frappe versions prior to 14.59.0, 15.5.0 and 15.5.0, which stems from a cross-site scripting vulnerabilit...

Frappe Technologies Frappe Cross-Site Scripting Vulnerability

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe prior to version 14.49.0, which can be exploited by a malicious Frappe user with desktop...

CVE-2023-41328

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to...

CVE-2023-41328 Possibility limited SQL injection due to insufficient validation in Frappe

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to...

CVE-2023-41328

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to...

PT-2023-27906 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 13.46.1 Frappe versions prior to 14.20.0 Description: A SQL Injection issue has been identified in the Frappe Framework, which could allow a malicious actor to access sensitive information. Recommendations: For versio...

CVE-2023-41328: Improper Neutralization of Special Elements used in an SQL Command

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to...

Frappe Technologies Frappe SQL Injection Vulnerability

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. Frappe suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to access sensitive information...