Vulnerabilities > Frappe

DATE CVE VULNERABILITY TITLE RISK
2024-02-07 CVE-2024-24812 Cross-site Scripting vulnerability in Frappe
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library.
network
low complexity
frappe CWE-79
5.4
2023-10-23 CVE-2023-46127 Cross-site Scripting vulnerability in Frappe
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library.
network
low complexity
frappe CWE-79
5.4
2023-10-12 CVE-2023-5555 Cross-site Scripting vulnerability in Frappe LMS 1.0.0
Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.
network
low complexity
frappe CWE-79
6.1
2023-09-21 CVE-2023-42807 Unspecified vulnerability in Frappe LMS 1.0.0
Frappe LMS is an open source learning management system.
network
low complexity
frappe
critical
9.8
2023-09-06 CVE-2023-41328 Unspecified vulnerability in Frappe
Frappe is a low code web framework written in Python and Javascript.
network
low complexity
frappe
7.5
2022-11-25 CVE-2022-41712 Path Traversal vulnerability in Frappe 14.10.0
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files.
network
low complexity
frappe CWE-22
6.5
2022-11-14 CVE-2022-3988 Cross-site Scripting vulnerability in Frappe
A vulnerability was found in Frappe.
network
low complexity
frappe CWE-79
6.1
2022-08-22 CVE-2022-28598 Cross-site Scripting vulnerability in Frappe Erpnext 12.29.0
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.
network
low complexity
frappe CWE-79
6.1
2022-06-22 CVE-2022-23057 Unspecified vulnerability in Frappe Erpnext
In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly.
network
low complexity
frappe
5.4
2020-12-11 CVE-2020-35175 Unspecified vulnerability in Frappe
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API.
network
low complexity
frappe
5.3