Threat database

CVE-2026-44440 is a path traversal vulnerability in the ERPNext software by frappe. It allows an authenticated adjacent attacker to read arbitrary files by exploiting improper limitation of pathnames to restricted directories. The issue affects versions prior to 15.101.1 and versions from 16.0.0-beta.1 up to but not including 16.10.0.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

CVE-2026-41430 is a reflected cross-site scripting (XSS) vulnerability in the redirect parameter on the login page of Press, a Frappe custom app used for managing Frappe Cloud infrastructure and services. The vulnerability allows improper neutralization of input during web page generation. A patch identified by commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 restricts redirects to internal URLs only, mitigating the issue. The vulnerability has a low CVSS score of 1.3 and no known exploits in the wild.

CVE-2026-41317 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability in the Frappe custom app 'press', which manages infrastructure and SaaS on Frappe Cloud. The vulnerable endpoint 'press.api.account.create_api_secret' allows database writes and is accessible via the GET method, enabling CSRF-like exploits. A patch has been committed that restricts this endpoint to POST requests only, mitigating the vulnerability.

CVE-2026-41320 is a medium severity SQL injection vulnerability in the Frappe HRMS product. Versions prior to 15.54.0 and 14.38.1 are affected. An attacker can send a specially crafted request to a certain endpoint to extract unauthorized information via SQL injection. The vulnerability has been patched in versions 15.54.0 and 14.

CVE-2026-40889 is an improper access control vulnerability in Frappe HRMS versions prior to 15.58.2 and 16.4.2. Authenticated users can exploit certain API endpoints to access unauthorized files. The issue is resolved in versions 15.58.2 and 16.4.

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

Frappe Learning Management System (LMS) versions prior to 2.46.0 have a vulnerability where quiz scores are calculated and enforced on the client side. This allows students to modify their quiz scores using browser developer tools before submission, compromising the integrity of quiz results. The vulnerability does not allow unauthorized access to other users' data or privilege escalation. The issue is fixed in version 2.46.0.

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.

ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0.

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0.

CVE-2026-23497 is a stored cross-site scripting (XSS) vulnerability in Frappe Learning Management System (LMS) versions 2.44.0 and earlier. The flaw arises from improper neutralization of input, specifically in image filenames, which can lead to execution of malicious JavaScript when these filenames are rendered on course or jobs pages. Although the CVSS 4.0 score is low (1.3), the vulnerability does not require privileges or authentication but does require user interaction. No known exploits are currently reported in the wild. European organizations using Frappe LMS should be aware of this issue and apply mitigations to prevent potential exploitation, especially in environments where user-generated content is displayed. The impact is limited by the low severity and the need for user interaction, but stored XSS can still lead to session hijacking or defacement if exploited.

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.

CVE-2025-67734 is a medium-severity cross-site scripting (XSS) vulnerability in the Frappe Learning Management System (LMS) versions prior to 2.42.0. Authenticated attackers can inject malicious JavaScript code via the Company Website field in the Job Form. This script executes in the browsers of users who view the affected job postings, potentially compromising user data or session integrity. The vulnerability requires attacker authentication but no user interaction beyond viewing the malicious content. It has a CVSS score of 5.1, reflecting moderate impact and ease of exploitation. The issue is resolved in version 2.42.

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.

SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned roles across multiple features. Because the affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server, users with low-privileged roles (such as students) could perform operations intended only for instructors or administrators via directly using the API's. This vulnerability is fixed in 2.41.0.

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.