PT-2026-24786 · Frappe+1 · Frappe

Odgrso · Publicado 2026-03-11 · Atualizado 2026-03-13 · CVE-2026-31879

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.100.2 Frappe versions prior to 15.101.0 Frappe versions prior to 16.10.0

Description Frappe is a full-stack web application framework. Due to insufficient validation and inadequate permission checks, users could modify other users' private workspaces. Specifically crafted requests could result in stored cross-site scripting (XSS).

Recommendations Update to Frappe version 14.100.2 or later. Update to Frappe version 15.101.0 or later. Update to Frappe version 16.10.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-31879

GHSA-QMHF-RGX2-8P25

Produtos afetados

Frappe

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31879.json · Exploit
• https://github.com/frappe/frappe/security/advisories/GHSA-qmhf-rgx2-8p25 · Aviso do Fabricante
• https://t.me/cveNotify/155451 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-31879 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31879 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031992366455013858 · Publicação no Twitter