www.vulncheck.com High-Risk SQL Injection Vulnerability in Frappe Framework Disclosed
Article Content
- •CVE-2026-114664 is a blind SQL injection vulnerability in Frappe Framework before version 16.33.0.
- •Authenticated attackers can exploit this flaw to extract sensitive database information.
- •Immediate upgrade to the patched version is recommended to mitigate risks.
A blind SQL injection vulnerability, CVE-2026-114664, has been identified in the Frappe Framework prior to version 16.33.0. This vulnerability affects authenticated users who can exploit the frappe.desk.doctype.event.event.get_events method to extract sensitive data from the database. The risk is deemed high, particularly for internet-facing applications, although there is no confirmed active exploitation at this time. Attackers can use low-privilege accounts to send crafted requests, potentially leading to privacy and regulatory issues. The vulnerability was published on October 22, 2026, with a CVSS score of 7.1. Organizations are advised to upgrade to the patched version and monitor for unusual activity related to the event endpoint.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-114664 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of Frappe are affected?
Is there active exploitation of this vulnerability?
What should organizations do to protect themselves?
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Exploited Arista Networks has patched a critical zero-day vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users, even those with basic privileges, to escalate their access to superuser status via a low-complexity SQL injection attack. This…