CVE-2026-119144

HighCVSS 8.8/10Last modified Nov 3, 2026

Description

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1336

Affected software

No affected versions have been published.

Timeline

Published: Oct 29, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1191459.9Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validat CVE-2026-1191465.6ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote CVE-2026-1191474.3ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE chec CVE-2026-1191486.5Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To CVE-2026-119155.9vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.CVE-2026-1191525.4The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scr CVE-2026-1191557.5The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and CVE-2026-1191567.2The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_reg[last_name], w CVE-2026-1191587.2The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t CVE-2026-1191606.4The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-S CVE-2026-1191627.2The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site CVE-2026-1191637.5The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based