Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-51769: Frappe blog and error pages allow script injection

CVE-2023-51769 · published 1 month ago

Summary

The Frappe platform (versions before 14.49.0) can let an attacker insert malicious code into blog or exception pages that other users view. This could lead to unauthorized actions or data theft through a web browser. Upgrade to version 14.49.0 or later, or apply the provided patches, to stop the risk.

What to do

Update frappe frappe to version 14.49.0 or later.

Affected software

Vendor	Product	Affected versions
frappe	frappe	< 14.49.0

Original advisory text

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.

References

https://github.com/frappe/frappe/compare/v14.48.1...v14.49.0 URL
https://nvd.nist.gov/vuln/detail/CVE-2023-51769 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51769... Vendor Advisory
https://github.com/frappe/frappe/security/advisories/GHSA-439c-3956-r8q7 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published14 Sep 2026

Updated4 Nov 2026

First seen14 Sep 2026

Sources

CVE-2023-51769 · NVD

CVE-2023-51769 · MITRE

CVE-2023-51769 · OSV

GHSA-439c-3956-r8q7 · GHSA

Track software like this

Free during beta