frappe kayıtları

frappe üreticisine ait 132 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren: 0 · %0
Silahlaştırılmış: 0 · %0
Pre-auth RCE: 3
Düzeltme kaydı olan: %25
Yayından KEV’e ortanca: KEV’e giren kayıt yok

Yıllara göre kayıt

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

Saldırı profili

Tüm kayıtlar

132 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
40Planlayın	CVE-2019-14965İstismar yok	An issue was discovered in Frappe Framework 10 through 12 before 12.0.4.frappe · frappe · CWE-94 Girişsiz RCE SSTI	Kritik9,8	—	%2,5	12 Ağu 2019
39İzleyin	CVE-2023-42807İstismar yok	Frappe LMS SQL Injection Issue on People Pagefrappe · learning · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,8	—	%0,3	21 Eyl 2023
39İzleyin	CVE-2026-38431İstismar yok	ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI).frappe · erpnext · CWE-94 Girişsiz RCE SSTI	Kritik9,8	—	%0,3	5 May 2026
39İzleyin	CVE-2025-66205İstismar yok	Frappe has the possibility of SQL Injection due to improper validationsfrappe · frappe · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,8	—	%0,3	1 Ara 2025
39İzleyin	CVE-2026-44442İstismar yok	ERPNext: Unauthorised Document modification due to missing validationfrappe · erpnext · CWE-862 Erişim denetimi (IDOR)	Kritik9,9	—	%0,2	13 May 2026
38İzleyin	CVE-2025-67289İstismar yok	An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code viafrappe · erpnext · CWE-79 Girişsiz RCE Dosya yükleme XSS	Kritik9,6	—	%0,4	22 Ara 2025
37İzleyin	CVE-2026-27471İstismar yok	ERP: Document access through endpoints due to missing validationfrappe · erpnext · CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,3	—	%0,3	21 Şub 2026
37İzleyin	CVE-2026-31877İstismar yok	Frappe SQL Injection due to improper field sanitizationfrappe · frappe · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,3	—	%0,2	11 Mar 2026
37İzleyin	CVE-2026-35614İstismar yok	Frappe has a SQL injection in bulk_updatefrappe · frappe · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,3	—	%0,2	7 Nis 2026
36İzleyin	CVE-2020-6145İstismar yok	An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38.frappe · erpnext · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%1,8	10 Ağu 2020
36İzleyin	CVE-2019-14966İstismar yok	An issue was discovered in Frappe Framework 10 through 12 before 12.0.4.frappe · frappe · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%1,6	12 Ağu 2019
36İzleyin	CVE-2025-68929İstismar yok	Frappe may be vulnerable remote code execution due to server-side template injectionfrappe · frappe · CWE-1336 RCE SSTI	Kritik9,0	—	%0,5	29 Ara 2025
36İzleyin	CVE-2025-65267İstismar yok	In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious Javfrappe · erpnext · CWE-79 XSS	Kritik9,0	—	%0,3	3 Ara 2025
36İzleyin	CVE-2025-58439İstismar yok	ERP: Possibility of SQL injection due to missing validationfrappe · erpnext · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,1	—	%0,3	5 Eyl 2025
36İzleyin	CVE-2026-31017İstismar yok	A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1,frappe · erpnext · CWE-918 Kimlik doğrulamasız SSRF	Kritik9,1	—	%0,2	8 Nis 2026
35İzleyin	CVE-2017-1000120İstismar yok	[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitfrappe · frappe · CWE-89 RCE SQL enjeksiyonu	Yüksek8,8	—	%1,1	4 Eki 2017
35İzleyin	CVE-2018-3885İstismar yok	An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6.frappe · erpnext · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,9	12 Eyl 2018
35İzleyin	CVE-2018-3884İstismar yok	An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6.frappe · erpnext · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,9	12 Eyl 2018
35İzleyin	CVE-2018-3882İstismar yok	An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6.frappe · erpnext · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,9	12 Eyl 2018
35İzleyin	CVE-2018-3883İstismar yok	An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6.frappe · erpnext · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,9	12 Eyl 2018
35İzleyin	CVE-2025-66437İstismar yok	An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0.frappe · erpnext · CWE-94 RCE SSTI	Yüksek8,8	—	%0,6	15 Ara 2025
35İzleyin	CVE-2025-66434İstismar yok	An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0.frappe · erpnext · CWE-94 RCE SSTI	Yüksek8,8	—	%0,5	15 Ara 2025
35İzleyin	CVE-2025-66438İstismar yok	A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism.frappe · erpnext · CWE-94 RCE SSTI	Yüksek8,8	—	%0,5	15 Ara 2025
35İzleyin	CVE-2025-66439İstismar yok	An issue was discovered in Frappe ERPNext through 15.89.0.frappe · erpnext · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,3	15 Ara 2025
35İzleyin	CVE-2025-66440İstismar yok	An issue was discovered in Frappe ERPNext through 15.89.0.frappe · erpnext · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,3	15 Ara 2025

CVE-2019-14965
40Planlayın
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4.
KritikCVSS 9,8İstismar yokEPSS %2
- Girişsiz RCE
- SSTI
frappe · frappe12 Ağu 2019
CVE-2023-42807
39İzleyin
Frappe LMS SQL Injection Issue on People Page
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
frappe · learning21 Eyl 2023
CVE-2026-38431
39İzleyin
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI).
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
- SSTI
frappe · erpnext5 May 2026
CVE-2025-66205
39İzleyin
Frappe has the possibility of SQL Injection due to improper validations
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
frappe · frappe1 Ara 2025
CVE-2026-44442
39İzleyin
ERPNext: Unauthorised Document modification due to missing validation
KritikCVSS 9,9İstismar yokEPSS %0
- Erişim denetimi (IDOR)
frappe · erpnext13 May 2026
CVE-2025-67289
38İzleyin
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via
KritikCVSS 9,6İstismar yokEPSS %0
- Girişsiz RCE
- Dosya yükleme
- XSS
frappe · erpnext22 Ara 2025
CVE-2026-27471
37İzleyin
ERP: Document access through endpoints due to missing validation
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
frappe · erpnext21 Şub 2026
CVE-2026-31877
37İzleyin
Frappe SQL Injection due to improper field sanitization
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
frappe · frappe11 Mar 2026
CVE-2026-35614
37İzleyin
Frappe has a SQL injection in bulk_update
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
frappe · frappe7 Nis 2026
CVE-2020-6145
36İzleyin
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38.
YüksekCVSS 8,8İstismar yokEPSS %1
- SQL enjeksiyonu
frappe · erpnext10 Ağu 2020
CVE-2019-14966
36İzleyin
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4.
YüksekCVSS 8,8İstismar yokEPSS %1
- SQL enjeksiyonu
frappe · frappe12 Ağu 2019
CVE-2025-68929
36İzleyin
Frappe may be vulnerable remote code execution due to server-side template injection
KritikCVSS 9,0İstismar yokEPSS %0
- RCE
- SSTI
frappe · frappe29 Ara 2025
CVE-2025-65267
36İzleyin
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious Jav
KritikCVSS 9,0İstismar yokEPSS %0
- XSS
frappe · erpnext3 Ara 2025
CVE-2025-58439
36İzleyin
ERP: Possibility of SQL injection due to missing validation
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
frappe · erpnext5 Eyl 2025
CVE-2026-31017
36İzleyin
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1,
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
frappe · erpnext8 Nis 2026
CVE-2017-1000120
35İzleyin
[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbit
YüksekCVSS 8,8İstismar yokEPSS %1
- RCE
- SQL enjeksiyonu
frappe · frappe4 Eki 2017
CVE-2018-3885
35İzleyin
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6.
YüksekCVSS 8,8İstismar yokEPSS %0
- SQL enjeksiyonu
frappe · erpnext12 Eyl 2018
CVE-2018-3884
35İzleyin
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6.
YüksekCVSS 8,8İstismar yokEPSS %0
- SQL enjeksiyonu
frappe · erpnext12 Eyl 2018
CVE-2018-3882
35İzleyin
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6.
YüksekCVSS 8,8İstismar yokEPSS %0
- SQL enjeksiyonu
frappe · erpnext12 Eyl 2018
CVE-2018-3883
35İzleyin
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6.
YüksekCVSS 8,8İstismar yokEPSS %0
- SQL enjeksiyonu
frappe · erpnext12 Eyl 2018
CVE-2025-66437
35İzleyin
An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0.
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- SSTI
frappe · erpnext15 Ara 2025
CVE-2025-66434
35İzleyin
An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0.
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- SSTI
frappe · erpnext15 Ara 2025
CVE-2025-66438
35İzleyin
A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism.
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- SSTI
frappe · erpnext15 Ara 2025
CVE-2025-66439
35İzleyin
An issue was discovered in Frappe ERPNext through 15.89.0.
YüksekCVSS 8,8İstismar yokEPSS %0
- SQL enjeksiyonu
frappe · erpnext15 Ara 2025
CVE-2025-66440
35İzleyin
An issue was discovered in Frappe ERPNext through 15.89.0.
YüksekCVSS 8,8İstismar yokEPSS %0
- SQL enjeksiyonu
frappe · erpnext15 Ara 2025