CVE-2023-46127: Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user…

PriorityP342medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

36.98%

98.3th percentile

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
frappe	frappe	< 14.49.0	14.49.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.