Frappe Framework versions before 15.121.0 and 16.x before 16.34.0 do not validate the destination path during certain file uploads. An authenticated user can write files outside the intended storage directory, which can lead to remote code execution on the server with a CVSS 4.0 score of 9.4 (Critical). The vendor and CNA rate it as critical, while VulDB lists a much lower base score of 6.3. Internet-facing instances or instances with many user accounts, including self-registration, carry the highest risk.
Frappe · Frappe Framework
Frappe Framework versions before 15.111.0 and 16.x before 16.21.0 render user-controlled message fields as templates without neutralization. An authenticated user with a common operational role can inject template expressions that the server evaluates in an unrestricted context. Successful exploitation can lead to code execution on the server, with high impact on confidentiality, integrity and availability, though the exact impact is not confirmed by the vendor.
Frappe · Frappe Framework
Frappe HRMS, an open-source human resources management system, contains an SQL injection flaw in some endpoints caused by missing input validation (CVSS 4.0: 8.3). Any authenticated user, including a low-privilege account, can send crafted requests to extract sensitive information from the database, potentially including personal and salary data. Exploitation requires a valid login but no user interaction.
Frappe · HRMS
The get_count() method in the reportview component of Frappe, a full-stack web framework used for applications such as ERPNext, builds a count query from generated SQL and executes it through a raw database path. Crafted report input can alter the SQL run by the application. An authenticated user with low privileges can read and potentially modify database content such as customer, invoice or HR data; availability impact is rated low.
Frappe · Frappe
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting (XSS) vulnerability (CVE-2026-109673). Record names are not properly neutralized when shown on some dashboards, tools and portals. An authenticated attacker who creates a crafted record name can run scripts in other users' browsers, which may allow data access, data modification and token theft, especially against privileged users.
Frappe · ERPNext
Frappe ERPNext renders a profile field on portal pages without escaping. A low-privilege user can store malicious script in this field, which runs in the browser of any administrator who views those pages. The advisory states that this is sufficient to take over the administrator's account and thereby the ERP system. User interaction by the administrator is required.
Frappe · ERPNext
An endpoint in Frappe ERPNext takes the record type from the request and inserts the record without permission checks. Any authenticated user, including one without an operational role, can create privileged accounts and take full control of the site. Because ERPNext holds financial and customer data, a takeover has a high impact. The attacker needs only a valid login, so exposure depends on who can log in, including self-registration or portal users.
Frappe · ERPNext
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in record fields, which are rendered into HTML attributes without escaping. A low-privilege user can store a malicious payload that runs in the browser of any privileged user who opens the affected page. This can lead to account takeover of the privileged user, which in ERPNext may expose finance and HR data. Exploitation requires the victim to open the affected page (user interaction).
Frappe · ERPNext
Frappe ERPNext versions before 15.119.1 and 16.x before 16.32.0 do not validate user-controlled message fields before template rendering. An authenticated user with a common operational role can inject template expressions that run in an unrestricted context. This allows reading and writing arbitrary database data, deleting documents, sending outbound requests from the server, and sending mail from the site.
Frappe · ERPNext
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 stores content submitted through a public-facing booking page without neutralization. An unauthenticated attacker can submit crafted content that is rendered as raw HTML in a privileged user's session, where it executes script. This can lead to the attacker acting as that user and taking over the account. The attack requires that a privileged user views the malicious entry.
Frappe · ERPNext
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain SQL injection flaws in several endpoints that lack input validation. Any authenticated user, including one without assigned roles, can send crafted requests to read sensitive data of other users and escalate to a privileged account. No user interaction is needed, and the attack is possible over the network with a valid login.
Frappe · ERPNext
ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting (XSS) flaw in a tool view that renders stored record names without escaping. An authenticated user who can create records can give them a malicious name, so script runs in the session of any user who later opens that tool. The attack requires a victim to open the affected tool view, and the flaw is not directly reachable from the internet.
Frappe · ERPNext
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting (XSS) vulnerability caused by missing input validation on a certain page. An attacker who lures a logged-in user into opening a crafted URL can run arbitrary JavaScript in the victim's authenticated session and take over the account. No privileges are required, but user interaction is needed, and the CVSS 4.0 score is 8.6 (High).
Frappe · ERPNext
Frappe Framework versions below 14.81.4 and 15.x below 15.41.0 contain a privilege management flaw in a certain document action. An authenticated user with the Website User role can combine this action with additional steps to obtain System Manager (administrative) privileges. The attack requires a valid Website User account, which is typically a portal or customer login; instances without such users are less exposed.
Frappe · Frappe Framework
Frappe framework versions before 13.32.0 use weak authentication for print view access. The print view key can be derived from data exposed by other whitelisted API endpoints, so an attacker can generate a valid key and view documents without the required permissions. The attack requires network access to the instance and high attack complexity, but no login or user interaction.
Frappe · Framework
