Browse CVEs

CRITICAL 9.8 CVE-2023-42807 Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerabi… Learning after 1.0.0 Fix from $2,3002023-09-21 HIGH 7.5 CVE-2023-41328 Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which … Frappe 13.46.1 / 14.20.0+ Fix from $1,9502023-09-06 MEDIUM 6.5 CVE-2022-41712 Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correc… Frappe No fix yet Fix from $1,6002022-11-25 MEDIUM 6.1 CVE-2022-3988 A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templa… Frappe after 14.14.3 Fix from $1,6002022-11-14 MEDIUM 6.1 CVE-2022-28598 Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is pla… Erpnext No fix yet Fix from $1,6002022-08-22 MEDIUM 5.5 CVE-2022-23055 In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker… Erpnext 13.1.0+ Fix from $1,6002022-06-22 MEDIUM 5.4 CVE-2022-23057 In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low priv… Erpnext 13.1.0+ Fix from $1,6002022-06-22 MEDIUM 5.3 CVE-2020-35175 Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API. Frappe after 12.12.0 Fix from $1,6002020-12-11 HIGH 7.5 CVE-2020-27508 In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security. Frappe 12.10.0+ Fix from $1,9502020-12-11 HIGH 8.8 CVE-2020-6145 An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause … Erpnext No fix yet Fix from $1,9502020-08-10 MEDIUM 6.1 CVE-2019-20514 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. Erpnext No fix yet Fix from $1,6002020-03-19 MEDIUM 6.1 CVE-2019-20515 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. Erpnext No fix yet Fix from $1,6002020-03-19 MEDIUM 6.1 CVE-2019-20516 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. Erpnext No fix yet Fix from $1,6002020-03-19 MEDIUM 6.1 CVE-2019-20517 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. Erpnext No fix yet Fix from $1,6002020-03-19 MEDIUM 6.1 CVE-2019-20518 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI. Erpnext No fix yet Fix from $1,6002020-03-19 MEDIUM 6.1 CVE-2019-20519 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address. Erpnext No fix yet Fix from $1,6002020-03-19 MEDIUM 6.1 CVE-2019-20520 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI. Erpnext No fix yet Fix from $1,6002020-03-19 MEDIUM 6.1 CVE-2019-20521 ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI. Erpnext No fix yet Fix from $1,6002020-03-19 HIGH 7.5 CVE-2019-20529 In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (… Frappe Patch available Fix from $1,9502020-03-18 MEDIUM 6.1 CVE-2019-20511 ERPNext 11.1.47 allows blog?blog_category= Frame Injection. Erpnext No fix yet Fix from $1,6002020-03-18 MEDIUM 6.1 CVE-2019-15700 public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "… Frappe after 12.0.8 Fix from $1,6002019-08-27 CRITICAL 9.8 CVE-2019-14965 An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists. Frappe 12.0.4+ Fix from $2,3002019-08-12 HIGH 8.8 CVE-2019-14966 An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection. Frappe after 12.0.4 Fix from $1,9502019-08-12 MEDIUM 6.1 CVE-2019-14967 An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability. Frappe 11.1.46+ Fix from $1,6002019-08-12 HIGH 7.5 CVE-2018-20061 A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, man… Erpnext 11.0.3+ Fix from $1,9502018-12-11 HIGH 8.8 CVE-2018-3882 An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injectio… Erpnext No fix yet Fix from $1,9502018-09-12 HIGH 8.8 CVE-2018-3883 An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injectio… Erpnext No fix yet Fix from $1,9502018-09-12 HIGH 8.8 CVE-2018-3884 An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injectio… Erpnext No fix yet Fix from $1,9502018-09-12 HIGH 8.8 CVE-2018-3885 An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injectio… Erpnext No fix yet Fix from $1,9502018-09-12 MEDIUM 6.1 CVE-2018-11339 An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. Erpnext No fix yet Fix from $1,6002018-05-22