en
Frappe is an open-source software company and technology ecosystem that builds business applications, a full-stack web development platform, developer tools, and hosting services. Its products support business operations and application development, with software delivered for self-managed deployments and cloud use. Frappe presents its community and customer reach as global.
As of 11/08/2026, frappe recorded 128 security vulnerabilities in the last 90 days across 9 products, including 70 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, erpnext had the most security vulnerabilities in the frappe ecosystem, with 78 vulnerabilities—approximately 60.94% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2024-24813Frappe SQL Injection from reporting logicCVE-2024-24812Frappe Authenticated Reflected Cross site scripting (XSS) in portal pagesCVE-2023-46127Frappe vulnerable to HTML injection by any Desk userCVE-2023-42807Frappe LMS SQL Injection Issue on People PageCVE-2023-41328Possibility limited SQL injection due to insufficient validation in Frappe| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2024-24813Frappe SQL Injection from reporting logic | Exploitation statusNot exploited | FixNo | Affected productfrappe | Published03/20/2024 | SeverityHigh |
CVE-2024-24812Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages | Exploitation statusNot exploited | FixYes | Affected productfrappe | Published | |
CVE-2023-46127Frappe vulnerable to HTML injection by any Desk user | Exploitation statusNot exploited | FixYes | Affected productfrappe | Published10/23/2023 | |
CVE-2023-42807Frappe LMS SQL Injection Issue on People Page | Exploitation statusNot exploited | FixYes | Affected productlms | Published09/21/2023 | |
CVE-2023-41328Possibility limited SQL injection due to insufficient validation in Frappe | Exploitation statusNot exploited | FixNo | Affected productfrappe | Published | |
CVE-2022-23058ERPNext - Stored XSS in My Settings | Exploitation statusNot confirmed | FixYes | Affected productfrappe | Published06/22/2022 | |
CVE-2022-23057ERPNext - Stored XSS in My Profile | Exploitation statusNot confirmed | FixYes | Affected productfrappe | Published06/22/2022 | |
CVE-2022-23055ERPNext - Improper user access conrol | Exploitation statusNot confirmed | FixYes | Affected productfrappe | Published06/22/2022 |
258 Results | Page 6 of 6
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |