UpHeron
All vulnerabilities

Servers and applications

CVE-2023-41328

Possibility of limited SQL injection due to insufficient validation

Severity
High 7.5
Published
6 Sept 2023
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
13.46.1, 14.20.0
Also known as
GHSA-53wh-f67g-9679
Sources
NVD, Project advisories (GitHub)

Description

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · cpe:a:frappe:frappe
  • Every version before 13.46.1
  • From 14.0.0 before 14.20.0
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 13.46.1
  • Every version before 14.20.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-41328
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-41328
  • GitHub Advisory Database https://github.com/advisories/GHSA-53wh-f67g-9679
  • github.com https://github.com/frappe/frappe/security/advisories/GHSA-53wh-f67g-9679