CVE-2026-114664

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

CVE-2026-114664

The Frappe Framework before version 16.33.0 is vulnerable to a blind SQL injection in the frappe.desk.doctype.event.event.get_events method. The root cause is the failure to properly neutralize user-supplied input before it is included in SQL queries. Authenticated attackers can provide crafted i...

EUVD-2026-107699

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

CVE-2026-114664

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

CVE-2026-114664 Frappe before 16.33.0 Blind SQL Injection via get_events

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

CVE-2026-114664 Frappe before 16.33.0 Blind SQL Injection via get_events

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

Frappe SQL injection vulnerability

Frappe has an SQL injection vulnerability. This vulnerability arises because the frappe.desk.doctype.event.event.getevents method fails to properly sanitize user inputs before incorporating them into SQL queries. As a result, blind SQL injection is possible. Authenticated attackers can send...

CVE-2026-10029

The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.13.1 via the getevents. This makes it possible for unauthenticated attackers to extract sensitive data including...

CVE-2026-10029: Missing Authorization

The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.13.1 via the getevents. This makes it possible for unauthenticated attackers to extract sensitive data including...