Frappe is an open-source, web-based enterprise application framework and suite spanning ERP, CRM, HR, and learning management products that sit deep in business-critical workflows for mid-market and deployment-flexible organizations. Despite a narrow product portfolio, its position as a foundational platform architecture means that vulnerabilities propagate broadly across downstream implementations and customizations. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and recur through input-handling weakness classes including cross-site scripting, SQL injection, code injection, and improper access control that are endemic to web application frameworks and template engines. The exposure reflects the vendor's role as a generalized enterprise platform where authentication, data validation, and code-generation boundaries are subject to repeated redesign and extension by downstream organizations. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Frappe over time
Signals from CVEs in this vendor scope (131 CVEs).
131 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-44442CRITICAL ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data | May 13, 2026 | 9.9 | 38 | NO | NO |
CVE-2026-38431CRITICAL ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions t | May 5, 2026 | 9.8 | 37 | NO | NO |
CVE-2025-67289CRITICAL An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file. | Dec 22, 2025 | 9.6 | 35 | NO | NO |
CVE-2023-54345HIGH Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by ex | May 5, 2026 | 8.8 | 34 | NO | NO |
CVE-2026-39351CRITICAL Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit. | Apr 7, 2026 | 9.1 | 33 | NO | NO |
CVE-2022-28598MEDIUM Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a | Aug 22, 2022 | 6.1 | 33 | NO | YES |
CVE-2025-58439CRITICAL ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulne | Sep 6, 2025 | 9.1 | 32 | NO | NO |
CVE-2026-44446HIGH ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted reques | May 13, 2026 | 7.5 | 31 | NO | NO |
CVE-2026-31017CRITICAL A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficien | Apr 8, 2026 | 9.1 | 31 | NO | NO |
CVE-2026-27471CRITICAL ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allo | Feb 21, 2026 | 9.1 | 31 | NO | NO |
Signals from CVEs in this vendor scope (131 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Frappe.
Media articles that mention a CVE ID that affects a product developed by Frappe — matched by CVE ID, not by vendor name.