CVE-2023-54407

MediumCVSS 4.9/10Last modified Oct 14, 2026

Description

Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Oct 12, 2026
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-544086.1Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendCVE-2023-544094.8Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes CVE-2023-54415.5NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.CVE-2023-544104.3Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a mCVE-2023-544115.9Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed CVE-2023-544126.5Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows anCVE-2023-544136.1WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated CVE-2023-54437.5Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. TCVE-2023-54448.0A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to succesCVE-2023-54455.4An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL pCVE-2023-54475.5Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denCVE-2023-54488.8The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.