23 matches found
CVE-2025-56381
CVE-2025-56381 — Authenticated SQL Injection in ERPNext / Frappe via orderby and groupby Parameters 📌 Summary ERPNext v15.67.0 and Frappe Framework v15.72.4 contain multiple authenticated SQL injection vulnerabilities in the frappe.desk.reportview.get API endpoint. Malicious input to the orderby ...
CVE-2026-55823
Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...
CVE-2026-55823 Frappe: Possibility of SQL injection in reportview
Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...
CVE-2026-55823
The Frappe full-stack web application framework is vulnerable to SQL injection in versions prior to 16.23.0 . The flaw exists within the get_count() method in reportview , where the application composes a count operation around generated SQL using a raw database execution path. This allows an att...
CVE-2026-55823 Frappe: Possibility of SQL injection in reportview
Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...
CVE-2026-55823
Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...
CVE-2026-55823 Frappe: Possibility of SQL injection in reportview
Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...
EUVD-2026-98928
Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...
PT-2026-111729
Frappe is a full-stack web application framework. Prior to 16.23.0, the get count method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version...
CVE-2026-55823: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...
CVE-2026-47422
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2...
CVE-2026-47422 Frappe: Unrestricted API access to save_report
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2...
CVE-2026-47422
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2...
EUVD-2026-43099
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2...
CVE-2026-47422: Missing Authorization
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2...
PT-2026-57316
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2...
CVE-2025-56381
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the orderby and groupby parameters...
CVE-2025-56381
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the orderby and groupby parameters...