frappe has 148 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 121 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 111. The median CVSS is 6.5 (medium), with 5 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (57) and CWE-79 (25). Most affected products: ERPNext (83), Frappe (32), learning (9).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 121 prev 0
Weakness classes
Products
- ERPNext 83
- Frappe 32
- learning 9
- hrms 7
- lms 5
- crm 4
Worst active — by depth score
CVE-2025-66434High· 8.8An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.061CVE-2026-119145Critical· 9.9Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload55CVE-2026-65974Critical· 9.9ERPNext is a free and open source Enterprise Resource Planning tool55CVE-2026-111389High· 7.7Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation54CVE-2025-67289Critical· 9.6An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.53
frappe vulnerabilities
CVEs affecting frappe, newest first. Open any entry for full detail, references, and exploit status.
148 CVEsRSS
CVE-2026-65974Critical· 9.9ERPNext is a free and open source Enterprise Resource Planning tool
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without fo…
CVE-2026-31017Critical· 9.1A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When genera…
CVE-2025-68953High· 7.5Frappe is a full-stack web application framework
Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of p…
CVE-2025-68929Critical· 9.0Frappe is a full-stack web application framework
Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template be…
CVE-2025-68928Medium· 5.4Frappe CRM is an open-source customer relationship management tool
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the …
CVE-2025-67289Critical· 9.6An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.
CVE-2025-66440High· 8.8An issue was discovered in Frappe ERPNext through 15.89.0
An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext/accounts/doctype/payment_entry/payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitra…
CVE-2025-66439High· 8.8An issue was discovered in Frappe ERPNext through 15.89.0
An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitra…
CVE-2025-66438High· 8.8A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism
A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field…
CVE-2025-66437High· 8.8An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0
An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.render_template() with a context derived from the add…
CVE-2025-66436Medium· 4.3An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0
An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with…
CVE-2025-66435Medium· 4.3An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0
An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (contract_terms) using frappe.render_template(…
CVE-2025-66434High· 8.8PoCAn SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0
An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() w…
CVE-2025-67734Medium· 5.4Frappe Learning Management System (LMS) is a learning system that helps users structure their content
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposi…
CVE-2025-67730Medium· 5.4PoCFrappe Learning Management System (LMS) is a learning system that helps users structure their content
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course …
CVE-2025-10655High· 8.8SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.
SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.
CVE-2025-66581Medium· 6.5Frappe Learning Management System (LMS) is a learning system that helps users structure their content
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned ro…
CVE-2025-62779Medium· 5.4Frappe Learning is a learning system that helps users structure their content
Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input fields in the Job Form.
CVE-2025-62778Medium· 5.3Frappe Learning is a learning management system
Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL.
CVE-2025-62158Medium· 5.3Frappe Learning is a learning system that helps users structure their content
Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially expos…
CVE-2025-11283Low· 2.4A vulnerability was determined in Frappe LMS 2.35.0
A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be executed remote…
CVE-2025-11282Low· 2.4A vulnerability was found in Frappe LMS 2.34.x/2.35.0
A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the atta…
CVE-2025-11280Low· 3.7A flaw has been found in Frappe LMS 2.35.0
A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation causes direct request. The attack may be initiated remotely. The attack's comp…
CVE-2025-30217MediumFrappe has possibility of SQL injection due to improper validations
Frappe has possibility of SQL injection due to improper validations
CVE-2025-30213MediumFrappe has Possibility of Remote Code Execution due to improper validation
Frappe has Possibility of Remote Code Execution due to improper validation
CVE-2025-30214HighFrappe vulnerable to information disclosure leading to account takeover
Frappe vulnerable to information disclosure leading to account takeover
CVE-2025-30212MediumFrappe has possibility of SQL injection due to improper validations
Frappe has possibility of SQL injection due to improper validations
CVE-2022-28598Medium· 6.1PoCFrappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.