743 matches found
EUVD-2025-203388
A Server-Side Template Injection SSTI vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.gethtmlandstyle triggers the rendering of the html field inside a Print Format document using frappe.rendertemplatetemplate...
CVE-2025-66434
An SSTI Server-Side Template Injection vulnerability exists in the getdunninglettertext method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates bodytext using frappe.rendertemplate with a user-supplied context doc. Although Frappe uses a custom...
PT-2025-51259
Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions through 15.89.0 Description A Server-Side Template Injection SSTI issue exists in the Print Format rendering mechanism. The frappe.www.printview.get html and style API triggers the rendering of the html field inside a...
PT-2025-51252
An SSTI Server-Side Template Injection vulnerability exists in the get dunning letter text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates body text using frappe.render template with a user-supplied context doc. Although Frappe uses a custom...
CVE-2025-66438
CVE-2025-66438 describes a Server-Side Template Injection in Frappe ERPNext up to version 15.89.0, exploiting the Print Format rendering workflow. An authenticated attacker with permissions to create/modify a Print Format can inject arbitrary Jinja expressions into the html field. Saving the mali...
CVE-2025-66435
An SSTI Server-Side Template Injection vulnerability exists in the getcontracttemplate method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates contractterms using frappe.rendertemplate with a user-supplied context doc. Although Frappe uses a custom...
CVE-2025-66435
An SSTI Server-Side Template Injection vulnerability exists in the getcontracttemplate method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates contractterms using frappe.rendertemplate with a user-supplied context doc. Although Frappe uses a custom...
EUVD-2008-6598
Malware in sbrugna...
EUVD-2006-2919
Malware in sbrugna...
EUVD-2006-5573
Malware in sbrugna...
EUVD-2009-4402
Malware in sbrugna...
EUVD-2006-0172
Malware in sbrugna...
EUVD-2006-2925
Malware in sbrugna...
EUVD-2009-0299
Malware in sbrugna...
EUVD-2010-2018
Malware in sbrugna...
EUVD-2005-2557
Malware in sbrugna...
EUVD-2008-5698
Malware in sbrugna...
EUVD-2006-4710
Malware in sbrugna...
EUVD-2006-1689
Malware in sbrugna...
EUVD-2006-5752
Malware in sbrugna...