Frappe Before 16.33.0 Blind Sql Injection Via Get Events

Back www.vulncheck.com

Frappe Before 16.33.0 Blind Sql Injection Via Get Events

www.vulncheck.com • October 23, 2026

Share: View original

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

GitHub Security Advisory (GHSA-p4w2-9mr5-6prj)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk SQL Injection Vulnerability in Frappe Framework Disclosed A blind SQL injection vulnerability, CVE-2026-114664, has been identified in the Frappe Framework prior to version 16.33.0. This vulnerability affects authenticated users who can exploit the frappe.desk.doctype.event.event.get_events method to extract sensitive data from the database. The risk is deemed high, particularly for internet-facing applications, although there is no confirmed active exploitation at this time. Attackers can use low-privilege accounts to send crafted requests, potentially leading to privacy and regulatory issues. The vulnerability was published on October 22, 2026, with a CVSS score of 7.1. Organizations are advised to upgrade to the patched version and monitor for unusual activity related to the event endpoint. 1 sources 63

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-89 - SQL Injection

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application