CVE-2025-30214High▾ TwilightFrappe vulnerable to information disclosure leading to account takeover
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
0.4% → 0.4%
Making crafted requests could lead to information disclosure that could further lead to account takeover.
There's no workaround to fix this without upgrading.
Thanks to Thanh of Calif.io for reporting the issue
frappe < 14.89.0frappe >= 15.0.0, < 15.51.0Upgrade to a patched release:
frappe 14.89.0frappe 15.51.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-30213MediumFrappe has Possibility of Remote Code Execution due to improper validation
CVE-2025-30217MediumFrappe has possibility of SQL injection due to improper validations
CVE-2025-30212MediumFrappe has possibility of SQL injection due to improper validations
CVE-2026-81731Medium· 5.4Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description
CVE-2026-82634Medium· 6.5Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings
CVE-2026-119145Critical· 9.9Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload