Security Flaws in Frappe Framework Expose Self-Hosted ERPNext Users to Takeovers, XSS, and SQL Injection

July 1, 2025

Security Flaws in Frappe Framework Expose Self-Hosted ERPNext Users to Takeovers, XSS, and SQL Injection

The Frappe Framework, a widely used full-stack application platform that powers ERPNext, has been found vulnerable to three security issues, potentially affecting thousands of self-hosted deployments. …

Published Date:
Jul 02, 2025 (3 hours, 31 minutes ago)

Vulnerabilities has been mentioned in this article.

Source: Read More

Previous ArticleGraylog Flaw (CVE-2025-53106, CVSS 8.8): Privilege Escalation Via API Token Abuse

Next Article Pilz IndustrialPI 4 Alert: Critical Flaws (CVE-2025-41656 CVSS 10.0 RCE, CVE-2025-41648 Auth Bypass) Expose Industrial PCs

CodeSOD: A Unique Way to Primary Key

BrowserStack launches Figma plugin for detecting accessibility issues in design phase

Parasoft brings agentic AI to service virtualization in latest release

Node.js vs. Python for Backend: 7 Reasons C-Level Leaders Choose Node.js Talent

The best CRM software with email marketing in 2025: Expert tested and reviewed

This multi-port car charger can power 4 gadgets at once – and it’s surprisingly cheap

I’m a wearables editor and here are the 7 Pixel Watch 4 rumors I’m most curious about

8 ways I quickly leveled up my Linux skills – and you can too

The Intersection of Agile and Accessibility – A Series on Designing for Everyone

The Intersection of Agile and Accessibility – A Series on Designing for Everyone

Zero Trust & Cybersecurity Mesh: Your Org’s Survival Guide

Execute Ping Commands and Get Back Structured Data in PHP

A Tomb Raider composer has been jailed — His legacy overshadowed by $75k+ in loan fraud

A Tomb Raider composer has been jailed — His legacy overshadowed by $75k+ in loan fraud

“I don’t think I changed his mind” — NVIDIA CEO comments on H20 AI GPU sales resuming in China following a meeting with President Trump

Galaxy Z Fold 7 review: Six years later — Samsung finally cracks the foldable code

Security Flaws in Frappe Framework Expose Self-Hosted ERPNext Users to Takeovers, XSS, and SQL Injection

Security Flaws in Frappe Framework Expose Self-Hosted ERPNext Users to Takeovers, XSS, and SQL Injection

CVE-2025-44658 – Netgear RAX30 PHP-FPM Misconfigured Extension Bypass Vulnerability

CVE-2025-7393 – Drupal Mail Login Authentication Bypass

Rilasciato QEMU 10: Novità e Approfondimenti sulla Virtualizzazione Multi-Architettura

CVE-2025-5134 – Tmall Demo Cross-Site Scripting Vulnerability

Forget the Nintendo Switch 2 and buy one of our favorite handheld gaming PCs instead — The Lenovo Legion Go is now cheaper than $500, thanks to Amazon Prime Day

CVE-2025-6518 – Apache Jinja2 Template Handler Remote Template Injection Vulnerability

CVE-2025-1908 – GitLab Information Disclosure and Session Hijacking Vulnerability

Step aside, Siri: Perplexity’s new AI voice assistant for iPhone can take it from here

CVE-2025-25251 – FortiClient Mac Incorrect Authorization Privilege Escalation Vulnerability

You can now access Android, iPhone from Windows 11 Start menu and transfer files

Security Flaws in Frappe Framework Expose Self-Hosted ERPNext Users to Takeovers, XSS, and SQL Injection

Security Flaws in Frappe Framework Expose Self-Hosted ERPNext Users to Takeovers, XSS, and SQL Injection

Related Posts