---
id: CVE-2026-114664
title: Frappe before 16.33.0 Blind SQL Injection via get_events
summary: >-
  Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability
  in the frappe.desk.doctype.event.event.get_events method, which fails to
  properly neutralize user-supplied input before including it in SQL queries.
  Authenticat…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: frappe
product: frappe
affected:
  - frappe < 16.33.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T01:43:47.670Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114664'
references:
  - url: 'https://github.com/frappe/frappe/security/advisories/GHSA-p4w2-9mr5-6prj'
    label: GitHub Security Advisory (GHSA-p4w2-9mr5-6prj)
  - url: >-
      https://www.vulncheck.com/advisories/frappe-before-16.33.0-blind-sql-injection-via-get-events
    label: >-
      VulnCheck Advisory: Frappe before 16.33.0 Blind SQL Injection via
      get_events
tags:
  - cve.org
ingestedAt: '2026-10-22T02:23:25.181Z'
---

## Overview

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.

## Affected

- `frappe < 16.33.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.