CVE-2026-114664High· 7.1▾ TwilightFrappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticat…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.
frappe < 16.33.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55823High· 8.7Frappe is a full-stack web application framework
CVE-2026-55796Medium· 6.5Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
CVE-2026-111388Medium· 5.4Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
CVE-2026-111389High· 7.7Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
CVE-2026-66057Medium· 5.1Frappe is a full-stack web application framework
CVE-2026-109674Medium· 6.5Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation