Frappe Technologies Frappe SQL Injection Vulnerability

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. Frappe suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to access sensitive information...

PT-2023-27906 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 13.46.1 Frappe versions prior to 14.20.0 Description: A SQL Injection issue has been identified in the Frappe Framework, which could allow a malicious actor to access sensitive information. Recommendations: For versio...

Frappe Framework 13.4.0 Remote Code Execution

Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Date: 2023-06-07 Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frap...

Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)

Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Date: 2023-06-07 Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frap...

Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated) Vulnerability

Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frappe Framework uses...

Malicious Package

Overview frappe-framework is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious code in frappe-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fd4c91421f9d8f397b84256da7d774eaa4de780d5790b0b17a27315cc7c8479 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-460 Malicious code in frappe-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fd4c91421f9d8f397b84256da7d774eaa4de780d5790b0b17a27315cc7c8479 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Frappe Technologies Frappe 路径遍历漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe version 14.10.0, which stems from a failure to properly validate user-injected information...

Frappe Technologies Frappe 跨站脚本漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe prior to version 2.5.0, which stems from unknown functionality in the component Search in...

CVE-2020-35175

Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...

CVE-2020-35175

Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...

Design/Logic Flaw

Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...

CVE-2020-35175

Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...

CVE-2020-35175

CVE-2020-35175 affects Frappe Framework 12 and 13 where the vulnerability lies in the frappe.client API not properly validating the HTTP method . The root cause is stated as a method validation issue within that API. The connected documents corroborate the same details across multiple sources (NV...

Frappe Framework Input Validation Error Vulnerability

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. A security vulnerability exists in Frappe Framework 12 and 13 that stems from not properly validating Frappe's HTTP methods...

Frappe Authorization Issues Vulnerability

Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from the Frappe team. A security vulnerability exists in Frappe two-factor authentication, which stems from the fact that the system also responds by sending a 2fa secret key during two-factor...

CVE-2019-15700

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text...

CVE-2019-15700

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text...

Code injection

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text...