Export limit exceeded: 410207 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (4 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111938 | 1 Frappe | 1 Frappe Crm | 2026-10-19 | 4.3 Medium |
| Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals. | ||||
| CVE-2026-111937 | 1 Frappe | 1 Frappe Crm | 2026-10-19 | 5.4 Medium |
| Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications. | ||||
| CVE-2025-68928 | 1 Frappe | 2 Frappe, Frappe Crm | 2026-01-05 | 5.4 Medium |
| Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available. | ||||
| CVE-2025-11461 | 1 Frappe | 1 Frappe Crm | 2025-12-19 | 8.8 High |
| Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1. | ||||
Page 1 of 1.