Total 131 security vulnerabilities recorded for frappe software and firmware.
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Fr...
Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4....
Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerabil...
Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which c...
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correct...
A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templat...
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is plac...
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker ...
ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘use...
In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privi...
In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to co...
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API....
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security....
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause a...
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI....
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI....
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address....
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI....
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI....
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI....
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI....
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI....
In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (n...
ERPNext 11.1.47 allows blog?blog_category= Frame Injection....