Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
311 results · page 5 of 7
Apr 2, 2026Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2026-34606 · Other software · frappe · reported by GitHubMedium 6.9
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026ERP is a free and open source Enterprise Resource Planning tool.CVE-2026-32954 · Other software · frappe · reported by GitHubHigh 7.1
ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Frappe is a full-stack web application framework.CVE-2026-31879 · Other software · frappe · reported by GitHubMedium 5.1
Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users could modify other user's private workspaces. Specially crafted requests could lead to stored XSS here. This vulnerability is fixed in 14.100.2, 15.101.0, and 16.10.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Frappe is a full-stack web application framework.CVE-2026-31878 · Other software · frappe · reported by GitHubMedium 5
Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 14.100.1, 15.100.0, and 16.6.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Frappe is a full-stack web application framework.CVE-2026-31877 · Other software · frappe · reported by GitHubCritical 9.3
Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Frappe is a full-stack web application framework.CVE-2026-29081 · Other software · frappe · reported by GitHubMedium 6.5
Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and 15.100.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Frappe is a full-stack web application framework.CVE-2026-29077 · Other software · frappe · reported by GitHubHigh 7.1
Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Frappe is a full-stack web application framework.CVE-2026-28436 · Other software · frappe · reported by GitHubLow 1.3
Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 and 15.102.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026ERP is a free and open source Enterprise Resource Planning tool.CVE-2026-27471 · Other software · frappe · reported by GitHubCritical 9.3
ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2026-26977 · Other software · frappe · reported by GitHubMedium 6.9
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2026-26031 · Other software · frappe · reported by GitHubLow 1.3
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Frappe is a full-stack web application framework.CVE-2026-25956 · Other software · frappe · reported by GitHubMedium 6.1
Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could lead to an open redirect (or reflected XSS, depending on the crafted payload) when a user signs up. This vulnerability is fixed in 14.99.14 and 15.94.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text.CVE-2025-65924 · Other software · Frappe · reported by MITREMedium 4.1
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files generated by the ERP system are generally considered trustworthy, users are highly likely to click these links, potentially enabling phishing attacks or malware delivery. This issue occurs in the Add Quality Goal' function.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing RecordsoCVE-2025-65923 · Other software · Frappe · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. An attacker can embed malicious JavaScript code into a CSV field, which is then stored in the database and executed whenever the affected record is viewed by a user within the ERPNext web interface. This exposure may allow an attacker to compromise user sessions or perform unauthorized actions under the context of a victim's account.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2026-23497 · Other software · frappe · reported by GitHubLow 1.3
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript when rendered on course or jobs pages.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Frappe is a full-stack web application framework.CVE-2025-68953 · Other software · frappe · reported by GitHubHigh 7.5
Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Frappe is a full-stack web application framework.CVE-2025-68929 · Other software · frappe · reported by GitHubCritical 9
Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Frappe CRM is an open-source customer relationship management tool.CVE-2025-68928 · Other software · frappe · reported by GitHubMedium 5.4
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.
- Product
- crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2025An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a craftedCVE-2025-67289 · Other software · Frappe · reported by MITRECritical 9.6
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Frappe ERPNext through 15.89.0.CVE-2025-66440 · Other software · Frappe · reported by MITREHigh 8.8
An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext/accounts/doctype/payment_entry/payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the to_posting_date parameter, which is directly interpolated into the query without proper sanitization or parameter binding.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comiamanc.github.io
Dec 15, 2025An issue was discovered in Frappe ERPNext through 15.89.0.CVE-2025-66439 · Other software · Frappe · reported by MITREHigh 8.8
An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the from_posting_date parameter, which is directly interpolated into the query without proper sanitization or parameter binding.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comiamanc.github.io
Dec 15, 2025A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism.CVE-2025-66438 · Other software · Frappe · reported by MITREHigh 8.8
A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field inside a Print Format document using frappe.render_template(template, doc) via the get_rendered_template() call chain. Although ERPNext wraps Jinja2 in a SandboxedEnvironment, it exposes sensitive functions such as frappe.db.sql through get_safe_globals(). An authenticated attacker with permission to create or modify a Print Format can inject arbitrary Jinja expressions into the html field. Once the malicious Print Format is saved, the attacker can call get_html_and_style() with a target document (e.g., Supplier or Sales Invoice) to trigger the render process. This leads to information disclosure from the database, such as database version, schema details, or sensitive values, depending on the injected payload. Exploitation flow: Create a Print Format with SSTI payload in the html field; call the get_html_and_style() API; triggers frappe.render_template(template, doc) inside get_rendered_template(); leaks database information via frappe.db.sql or o
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiamanc.github.ionotion.so
Dec 15, 2025An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0.CVE-2025-66437 · Other software · Frappe · reported by MITREHigh 8.8
An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.render_template() with a context derived from the address_dict parameter, which can be either a dictionary or a string referencing an Address document. Although ERPNext uses a custom Jinja2 SandboxedEnvironment, dangerous functions like frappe.db.sql remain accessible via get_safe_globals(). An authenticated attacker with permission to create or modify an Address Template can inject arbitrary Jinja expressions into the template field. By creating an Address document with a matching country, and then calling the get_address_display API with address_dict="address_name", the system will render the malicious template using attacker-controlled data. This leads to server-side code execution or database information disclosure.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiamanc.github.ionotion.so
Dec 15, 2025An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0.CVE-2025-66436 · Other software · Frappe · reported by MITREMedium 4.3
An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Terms and Conditions document can inject arbitrary Jinja expressions into the terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiamanc.github.ionotion.so
Dec 15, 2025An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0.CVE-2025-66435 · Other software · Frappe · reported by MITREMedium 4.3
An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (contract_terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Contract Template can inject arbitrary Jinja expressions into the contract_terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiamanc.github.ionotion.so
Dec 15, 2025An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0.CVE-2025-66434 · Other software · Frappe · reported by MITREHigh 8.8
An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to configure Dunning Type and its child table Dunning Letter Text can inject arbitrary Jinja expressions, resulting in server-side code execution within a restricted but still unsafe context. This can leak database information.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiamanc.github.ionotion.so
Dec 12, 2025Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2025-67734 · Other software · frappe · reported by GitHubMedium 5.1
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2025-67730 · Other software · frappe · reported by GitHubMedium 5.1
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This CVE-2025-10655 · Other software · Frappe · reported by help@fluidattacks.comHigh 8.6
SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.
- Product
- Frappe HelpDesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Dec 5, 2025Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2025-66581 · Other software · frappe · reported by GitHubLow 1.3
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned roles across multiple features. Because the affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server, users with low-privileged roles (such as students) could perform operations intended only for instructors or administrators via directly using the API's. This vulnerability is fixed in 2.41.0.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript.CVE-2025-65267 · Other software · Frappe · reported by MITRECritical 9
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Frappe is a full-stack web application framework.CVE-2025-66206 · Other software · frappe · reported by GitHubMedium 6.8
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Frappe is a full-stack web application framework.CVE-2025-66205 · Other software · frappe · reported by GitHubHigh 7.1
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.CVE-2025-11461 · Other software · Frappe · reported by help@fluidattacks.comHigh 7.1
Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.
- Product
- Frappe CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Nov 12, 2025Frappe Learning is a learning system that helps users structure their content.CVE-2025-64707 · Other software · frappe · reported by GitHubLow 1.2
Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, when admins revoked a role from the user, the effect was not immediate because of caching. The issue has been fixed in version 2.41.0 by ensuring the cache is cleared after roles are updated.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Frappe Learning is a learning system that helps users structure their content.CVE-2025-64705 · Other software · frappe · reported by GitHubLow 1.3
Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access the submissions made by other students The issue has been fixed in version 2.41.0 by ensuring proper roles and redirecting if accessed via direct URL.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025Frappe Learning is a learning system that helps users structure their content.CVE-2025-62779 · Other software · frappe · reported by GitHubLow 1.2
Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input fields in the Job Form.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025Frappe Learning is a learning management system.CVE-2025-62778 · Other software · frappe · reported by GitHubLow 1.3
Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Frappe is a full-stack web application framework.CVE-2025-62407 · Other software · frappe · reported by GitHubMedium 6.1
Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument on the login page, if a specific type of URL was passed in. This vulnerability is fixed in 14.98.0 and 15.83.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Frappe Learning is a learning system that helps users structure their content.CVE-2025-62158 · Other software · frappe · reported by GitHubLow 2.7
Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2025A vulnerability was determined in Frappe LMS 2.35.0.CVE-2025-11283 · Other software · Frappe · reported by VulDBLow 1.9
A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 5, 2025A vulnerability was found in Frappe LMS 2.34.x/2.35.0.CVE-2025-11282 · Other software · Frappe · reported by VulDBLow 1.9
A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 5, 2025A vulnerability has been found in Frappe LMS 2.35.0.CVE-2025-11281 · Other software · Frappe · reported by VulDBLow 1.3
A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Handler. Such manipulation leads to improper access controls. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. You should upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 5, 2025A flaw has been found in Frappe LMS 2.35.0.CVE-2025-11280 · Other software · Frappe · reported by VulDBLow 2.9
A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation causes direct request. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 2, 2025ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and grCVE-2025-56381 · Other software · Frappe · reported by MITREMedium 6.5
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a CVE-2025-56380 · Other software · Frappe · reported by MITREMedium 6.5
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a cCVE-2025-56379 · Other software · Frappe · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to CVE-2025-52042 · Other software · Frappe · reported by MITREHigh 8.2
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL InjecCVE-2025-52041 · Other software · Frappe · reported by MITREHigh 8.2
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventory_dimensions_dict parameter.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extrCVE-2025-52040 · Other software · Frappe · reported by MITREHigh 8.2
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanket_order_type parameter.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.