Threats affecting pkg:github/Frappe Framework

8 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	4.6	EPSS 0.3%	CVE-2026-50711Frappe Framework · XSS or 'Cross-site Scripting' Medium4.6EPSS 0.3%2026-06-24CVE Database V5CVE-2026-50711 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Number Card component. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2026-06-24
Medium	4.8	EPSS 0.3%	CVE-2026-50709Frappe Framework · XSS or 'Cross-site Scripting' Medium4.8EPSS 0.3%2026-06-24CVE Database V5CVE-2026-50709 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Notifications > Events panel. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2026-06-24
Medium	4.8	EPSS 0.3%	CVE-2026-50708Frappe Framework · XSS or 'Cross-site Scripting' Medium4.8EPSS 0.3%2026-06-24CVE Database V5CVE-2026-50708 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2026-06-24
Medium	4.6	EPSS 0.3%	CVE-2026-50704Frappe Framework · XSS or 'Cross-site Scripting' Medium4.6EPSS 0.3%2026-06-24CVE Database V5CVE-2026-50704 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the File View breadcrumb renderer. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2026-06-24
Medium	4.8	EPSS 0.4%	CVE-2026-50703Frappe Framework · XSS or 'Cross-site Scripting' Medium4.8EPSS 0.4%2026-06-24CVE Database V5CVE-2026-50703 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2026-06-24
Medium	5.1	EPSS 0.5%	CVE-2026-50701Frappe Framework · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.5%2026-06-24CVE Database V5CVE-2026-50701 A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component. EPSS 0.5%Vulnerability CWE-79	CVE Database V5	2026-06-24
Medium	4.6	EPSS 0.4%	CVE-2026-50700Frappe Framework · XSS or 'Cross-site Scripting' Medium4.6EPSS 0.4%2026-06-24CVE Database V5CVE-2026-50700 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2026-06-24
Medium	4.6	EPSS 0.3%	CVE-2026-50698Frappe Framework · XSS or 'Cross-site Scripting' Medium4.6EPSS 0.3%2026-06-24CVE Database V5CVE-2026-50698 A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2026-06-24

Page 1 of 1