Live › vulnerability › CVE-2026-114664
Go to dashboardFrappe Framework versions before 16.33.0 let an authenticated user send crafted input to the get_events method, which places it unescaped into a SQL query. The attacker can infer database contents from application behavior and extract sensitive data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Frappe Framework before 16.33.0, including ERPNext and other Frappe apps built on it, where users can log in to the Desk. Exposure requires an account, so sites with no user login (or only public static pages) are not exposed through this path. unknown whether the sources name specific roles or settings that narrow exposure further.
No product ranges from the sources yet.
bench version or frappe.__version__ and compare it to 16.33.016.33.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.
This page as .md · .json · in your agent: get_signal("CVE-2026-114664")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.