Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
311 results · page 6 of 7
Oct 1, 2025In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable toCVE-2025-52039 · Other software · Frappe · reported by MITREHigh 8.2
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable tCVE-2025-52050 · Other software · Frappe · reported by MITREMedium 6.5
In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expiry_date parameter.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which alCVE-2025-52049 · Other software · Frappe · reported by MITREMedium 6.5
In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extrCVE-2025-52047 · Other software · Frappe · reported by MITREMedium 6.5
In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL CVE-2025-52043 · Other software · Frappe · reported by MITREMedium 6.5
In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).CVE-2025-59421 · Other software · frappe · reported by GitHubLow 2.7
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood the inbox of a user by repeatedly sending invites (duplicate). The issue is fixed in commit 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615.
- Product
- press
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Frappe Learning is a learning system that helps users structure their content.CVE-2025-59415 · Other software · frappe · reported by GitHubMedium 4.6
Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learning where the system did not adequately sanitize the content uploaded in the profile bio. Malicious SVG files could be used to execute arbitrary scripts in the context of other users.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all iCVE-2025-52044 · Other software · Frappe · reported by MITREHigh 7.5
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventory_dimensions_dict parameter.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which CVE-2025-52048 · Other software · Frappe · reported by MITREMedium 6.5
In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which allows an attacker to extract information from databases by injecting a SQL query into the `dt` parameter.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025ERP is a free and open source Enterprise Resource Planning tool.CVE-2025-58439 · Other software · frappe · reported by GitHubHigh 8.1
ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retrieved. This issue is fixed in versions 14.89.2 and 15.76.0.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Frappe is a full-stack web application framework.CVE-2025-58375 · Other software · frappe · reported by GitHubHigh 8.1
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Frappe is a full-stack web application framework.CVE-2025-55732 · Other software · frappe · reported by GitHubHigh 8.7
Frappe is a full-stack web application framework. Prior to 15.74.2 and 14.96.15, an attacker could implement SQL injection through specially crafted requests, allowing malicious people to access sensitive information. This vulnerability is a bypass of the official patch released for CVE-2025-52895. This vulnerability is fixed in 15.74.2 and 14.96.15.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Frappe is a full-stack web application framework.CVE-2025-55731 · Other software · frappe · reported by GitHubMedium 6.3
Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025Frappe Learning is a learning system that helps users structure their content.CVE-2025-55006 · Other software · frappe · reported by GitHubMedium 4.3
Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. A fix for this issue is planned for version 2.34.0.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).CVE-2025-53545 · Other software · frappe · reported by GitHubMedium 6.9
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit ddb439f8eb1816010f2ef653a908648b71f9bba8.
- Product
- press
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025Frappe is a full-stack web application framework.CVE-2025-52898 · Other software · frappe · reported by GitHubHigh 8.7
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue has been patched in versions 14.94.3 and 15.58.0. Workarounds for this issue involve verifying password reset URLs before clicking on them or upgrading for self hosted users.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025Frappe is a full-stack web application framework.CVE-2025-52896 · Other software · frappe · reported by GitHubHigh 8.6
Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025Frappe is a full-stack web application framework.CVE-2025-52895 · Other software · frappe · reported by GitHubHigh 8.7
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for this issue other than upgrading.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3.CVE-2025-28062 · Other software · Frappe · reported by MITREHigh 8.1
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Frappe is a full-stack web application framework.CVE-2025-30217 · Other software · frappe · reported by GitHubMedium 6.6
Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 contain a patch for the issue. No known workarounds are available.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Frappe is a full-stack web application framework.CVE-2025-30214 · Other software · frappe · reported by GitHubHigh 8
Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Frappe is a full-stack web application framework.CVE-2025-30213 · Other software · frappe · reported by GitHubMedium 6.3
Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Frappe is a full-stack web application framework.CVE-2025-30212 · Other software · frappe · reported by GitHubMedium 6.6
Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).CVE-2024-50356 · Other software · frappe · reported by GitHubNone
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be reset by anyone who have access to the mail inbox circumventing the 2FA. Even though they wouldn't be able to login by bypassing the 2FA. Only users who have enabled 2FA are affected. Commit ba0007c28ac814260f836849bc07d29beea7deb6 patches this bug.
- Product
- press
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).CVE-2024-49751 · Other software · frappe · reported by GitHubLow 1.2
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd, a user could inject HTML through SaaS signup inputs. The user who injected the unsafe HTML code would only affect themselves and would not affect other users. Commit 5d118a902872d7941f099ad1fb918e2421e79ccd patches this bug.
- Product
- press
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView.CVE-2024-38992 · Other software · airvert_thuan · reported by MITREHigh 8.8
airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- frappejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 14, 2024Frappe is a full-stack web application framework.CVE-2024-34074 · Other software · frappe · reported by GitHubMedium 6.1
Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Frappe is a full-stack web application framework.CVE-2024-27105 · Other software · frappe · reported by GitHubHigh 8.1
Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds are available.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Frappe is a full-stack web application framework.CVE-2024-24813 · Other software · frappe · reported by GitHubHigh 7.5
Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access to data which the user doesn't have permission to access. Versions 14.64.0 and 15.0.0 contain a patch for this issue. No known workarounds are available.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library.CVE-2024-24812 · Other software · frappe · reported by GitHubMedium 5.4
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library.CVE-2023-46127 · Other software · frappe · reported by GitHubMedium 5.4
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2023Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.CVE-2023-5555 · Other software · frappe · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.
- Product
- frappe/lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023Frappe LMS is an open source learning management system.CVE-2023-42807 · Other software · frappe · reported by GitHubMedium 6.3
Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Frappe is a low code web framework written in Python and Javascript.CVE-2023-41328 · Other software · frappe · reported by GitHubMedium 4.2
Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files.CVE-2022-41712 · Other software · Frappe · reported by help@fluidattacks.comMedium 6.5
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file parameter.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Nov 14, 2022A vulnerability was found in Frappe.CVE-2022-3988 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cross site scripting. The attack may be launched remotely. The name of the patch is bfab7191543961c6cb77fe267063877c31b616ce. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213560.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in outpCVE-2022-28598 · Other software · Frappe · reported by MITREMedium 6.1
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 22, 2022In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality.CVE-2022-23055 · Other software · frappe · reported by vulnerabilitylab@mend.ioMedium 5.5
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ fieCVE-2022-23058 · Other software · frappe · reported by vulnerabilitylab@mend.ioLow 3.5
ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly.CVE-2022-23057 · Other software · frappe · reported by vulnerabilitylab@mend.ioMedium 5.4
In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2020Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API.CVE-2020-35175 · Other software · Frappe · reported by MITREMedium 5.3
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2020In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security.CVE-2020-27508 · Other software · Frappe · reported by MITREHigh 7.5
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2020An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38.CVE-2020-6145 · Other software · Frappe · reported by talos-cna@cisco.comHigh 8.8
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Mar 19, 2020ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.CVE-2019-20521 · Other software · Frappe · reported by MITREMedium 6.1
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Mar 19, 2020ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.CVE-2019-20520 · Other software · Frappe · reported by MITREMedium 6.1
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Mar 19, 2020ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.CVE-2019-20519 · Other software · Frappe · reported by MITREMedium 6.1
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Mar 19, 2020ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.CVE-2019-20518 · Other software · Frappe · reported by MITREMedium 6.1
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Mar 19, 2020ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.CVE-2019-20517 · Other software · Frappe · reported by MITREMedium 6.1
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Mar 19, 2020ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.CVE-2019-20516 · Other software · Frappe · reported by MITREMedium 6.1
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Mar 19, 2020ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.CVE-2019-20515 · Other software · Frappe · reported by MITREMedium 6.1
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.