CVE-2026-114664GHSA-p4w2-9mr5-6prj
Frappe before 16.33.0 Blind SQL Injection via get_events
frappe frappe
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 16.33.0frappeCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.
Text from CVE List
Affected versions 2
- frappeaffected: all versions before 16.33.0CVE List
- frappeunaffected: 16.33.0CVE List