CVE-2024-34074

CVE-2024-34074 affects Frappe, a full‑stack web framework. The vulnerability concerns the login page accepting a redirect argument, enabling redirects to untrusted external URLs and phishing risk. Affected versions before 14.74.0 and before 15.26.0 are fixed in 14.74.0 and 15.26.0, respectively. ...

CVE-2024-27105

Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds...