CVE-2026-28436

概要

参考情報

• frappe/frappe security advisory · Vendor Advisory

frappe のその他の脆弱性

• CVE-2026-81731中 5.4Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspa…
• CVE-2026-3837中 5.4An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user open…
• CVE-2026-3673中 5.4An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report v…
• CVE-2026-31017緊急 9.1A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1,…
• CVE-2026-39351緊急 9.1Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.