Filtered by vendor Frappe
Subscriptions
Total
32 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-5555 | 1 Frappe | 1 Frappe Lms | 2024-09-17 | 6.1 Medium |
| Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4. | ||||
| CVE-2022-23056 | 1 Frappe | 1 Erpnext | 2024-09-17 | N/A |
| In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack. | ||||
| CVE-2017-1000120 | 1 Frappe | 1 Frappe | 2024-09-17 | N/A |
| [ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter. | ||||
| CVE-2022-23055 | 1 Frappe | 1 Erpnext | 2024-09-16 | N/A |
| In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users. | ||||
| CVE-2022-23058 | 1 Frappe | 1 Erpnext | 2024-09-16 | N/A |
| ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover. | ||||
| CVE-2022-23057 | 1 Frappe | 1 Erpnext | 2024-09-16 | 5.4 Medium |
| In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile. | ||||
| CVE-2023-46127 | 1 Frappe | 1 Frappe | 2024-09-11 | 5.4 Medium |
| Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0. | ||||
| CVE-2018-20061 | 1 Frappe | 1 Erpnext | 2024-08-05 | N/A |
| A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call. | ||||
| CVE-2018-11339 | 1 Frappe | 1 Erpnext | 2024-08-05 | N/A |
| An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. | ||||
| CVE-2019-20529 | 1 Frappe | 1 Frappe | 2024-08-05 | 7.5 High |
| In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) instead of private files. | ||||
| CVE-2019-20518 | 1 Frappe | 1 Erpnext | 2024-08-05 | 6.1 Medium |
| ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI. | ||||
| CVE-2019-20515 | 1 Frappe | 1 Erpnext | 2024-08-05 | 6.1 Medium |
| ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. | ||||
| CVE-2019-20517 | 1 Frappe | 1 Erpnext | 2024-08-05 | 6.1 Medium |
| ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. | ||||
| CVE-2019-20511 | 1 Frappe | 1 Erpnext | 2024-08-05 | 6.1 Medium |
| ERPNext 11.1.47 allows blog?blog_category= Frame Injection. | ||||
| CVE-2019-20514 | 1 Frappe | 1 Erpnext | 2024-08-05 | 6.1 Medium |
| ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. | ||||
| CVE-2019-20520 | 1 Frappe | 1 Erpnext | 2024-08-05 | 6.1 Medium |
| ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI. | ||||
| CVE-2019-20521 | 1 Frappe | 1 Erpnext | 2024-08-05 | 6.1 Medium |
| ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI. | ||||
| CVE-2019-20519 | 1 Frappe | 1 Erpnext | 2024-08-05 | 6.1 Medium |
| ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address. | ||||
| CVE-2019-20516 | 1 Frappe | 1 Erpnext | 2024-08-05 | 6.1 Medium |
| ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. | ||||
| CVE-2019-15700 | 1 Frappe | 1 Frappe | 2024-08-05 | N/A |
| public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text. | ||||