Log in Start free

Frappe

Products

ProductCVEsExploitedLatest
ERPNext95–Oct 16, 2026
Frappe94–Oct 29, 2026
LMS28–Oct 30, 2026
Frappe Framework12–Jun 24, 2026
hrms11–Nov 3, 2026
press6–Apr 24, 2026
crm6–Oct 26, 2026
builder3–Oct 26, 2026
suite1–Oct 12, 2026
Frappe CRM1–Nov 26, 2025
Frappe HelpDesk1–Dec 9, 2025
frappe/lms1–Oct 12, 2023
helpdesk1–Oct 19, 2026
HR1–Sep 28, 2026

Exploited and recent CVEs

  • CVE-2026-121442 Medium 4.3 Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API 0.2%
  • CVE-2026-61806 Medium 5.3 Frappe LMS allows unpublished certificate access 0.2%
  • CVE-2026-61805 Medium 5.3 Frappe LMS: Quiz result manipulation and cross-user submission forgery 0.2%
  • CVE-2026-61803 Medium 5.3 Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount 0.2%
  • CVE-2026-39375 Medium 5.1 Frappe LMS has Stored XSS in Course Meta 0.3%
  • CVE-2026-119145 Critical 9.9 Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload 0.8%
  • CVE-2026-119144 High 8.8 Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields 0.3%
  • CVE-2026-116492 Medium 6.5 Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API 0.2%
  • CVE-2026-115720 Medium 5.0 Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect 0.3%
  • CVE-2026-115717 High 7.7 Frappe Builder before 1.36.1 SSRF via convert_to_webp 0.3%
  • CVE-2026-115718 Medium 4.3 Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt 0.3%
  • CVE-2026-114664 High 7.1 Frappe before 16.33.0 Blind SQL Injection via get_events 0.2%
  • CVE-2026-111939 Medium 4.6 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation 0.2%
  • CVE-2026-111938 Medium 4.3 Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log 0.3%
  • CVE-2026-111937 Medium 5.4 Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records 0.2%
  • CVE-2026-64862 Medium 6.5 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS 0.2%
  • CVE-2026-55796 Medium 6.5 Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report 0.3%
  • CVE-2026-108373 Medium 6.5 ERPNext: Unauthorised access to financial data due to missing validation 0.2%
  • CVE-2026-108374 High 7.7 ERPNext: Unauthorised status modification due to missing validation 0.2%
  • CVE-2026-111389 High 7.7 Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation 0.3%
  • CVE-2026-111388 Medium 5.4 Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication 0.2%
  • CVE-2026-55823 High 8.7 Frappe: Possibility of SQL injection in reportview 0.4%
  • CVE-2026-66057 Medium 5.1 Frappe: Open Redirect via Unsanitized OAuth State Param. 0.4%
  • CVE-2026-109675 Medium 4.3 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs 0.2%
  • CVE-2026-109674 Medium 6.5 Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation 0.3%
  • CVE-2026-109673 High 7.3 Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names 0.2%
  • CVE-2026-109672 Medium 6.5 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data 0.3%
  • CVE-2026-109671 High 7.3 Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages 0.2%
  • CVE-2026-109670 Medium 5.4 Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name 0.2%
  • CVE-2026-109669 Medium 4.3 Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification 0.2%