Frappe vulnerabilities
We track 98 vulnerabilities in Frappe products across 12 products. 98 are rated high or critical, and none are known to be exploited. The most recent was published on November 14, 2026.
Latest Frappe vulnerabilities
- 8.2 High severity
Erpnext: Improper Neutralization of Special Elements used in an SQL Command
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanket_order_type parameter.
- 8.2 High severity
Erpnext: Improper Neutralization of Special Elements used in an SQL Command
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQ
- 7.5 High severity
Erpnext: Improper Neutralization of Special Elements used in an SQL Command
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventory_dimensions_dict parameter.
- 9.1 Critical severity
erpnext: Improper Neutralization of Special Elements used in an SQL Command
ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retri
- 8.1 High severity
frappe: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning ca
- 7.5 High severity
frappe: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a full-stack web application framework. Prior to 15.74.2 and 14.96.15, an attacker could implement SQL injection through specially crafted requests, allowing malicious people to access sensitive information. This vulnerability is a bypass of the offi
- 8.8 High severity
frappe: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.
- 8.8 High severity
Frappe Learning is a learning system that helps users structure their content.
Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or
- 8.8 High severity
frappe: Exposure of Sensitive Information to an Unauthorized Actor
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured
- 7.5 High severity
frappe: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in
- 8.1 High severity
Erpnext: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protectio
- 7.5 High severity
frappe: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 con
- 7.5 High severity
frappe: Exposure of Sensitive Information to an Unauthorized Actor
Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround
- 8.8 High severity
Frappe is a full-stack web application framework.
Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerab
- 7.5 High severity
frappe: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix
- 7.5 High severity
frappe: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access to data which the user doesn't have permission to access. Versions 14.64.0 and 15.0.0 contain a patc
- 9.8 Critical severity
lms: Improper Neutralization of Special Elements used in an SQL Command
Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest m
- 7.5 High severity
frappe: Improper Neutralization of Special Elements used in an SQL Command
Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.