CVE-2023-41328

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
frappe	frappe	< 13.46.1; >= 14.0.0, < 14.20.0

References

https://github.com/frappe/frappe/releases/tag/v13.46.1Third Party Advisory
https://github.com/frappe/frappe/releases/tag/v14.20.0Third Party Advisory
https://github.com/frappe/frappe/security/advisories/GHSA-53wh-f67g-9679Third Party Advisory
https://github.com/frappe/frappe/releases/tag/v13.46.1Third Party Advisory
https://github.com/frappe/frappe/releases/tag/v14.20.0Third Party Advisory
https://github.com/frappe/frappe/security/advisories/GHSA-53wh-f67g-9679Third Party Advisory

Timeline

Published: Sep 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-413296.6WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as doc CVE-2023-41335.5A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a CVE-2023-413309.8knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. ## Issue On March 17th the vu CVE-2023-413319.8SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, a CVE-2023-413323.5Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy h CVE-2023-413338.1Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CVE-2023-413348.4Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy c CVE-2023-413353.7Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new CVE-2023-413366.5ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit a CVE-2023-413376.7h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to mu CVE-2023-413385.3Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to CVE-2023-413395.3GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defin