CVE-2026-55823

UNKNOWN 0.0

Frappe: Possibility of SQL injection in reportview

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.

CWE	CWE-89
Vendor	frappe
Product	frappe
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for frappe frappe

Be the first to know when new unknown vulnerabilities affecting frappe frappe are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

frappe / frappe

< 16.23.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7 github.com: https://github.com/frappe/frappe/pull/40022 github.com: https://github.com/frappe/frappe/pull/40027 github.com: https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b github.com: https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690 github.com: https://github.com/frappe/frappe/releases/tag/v16.23.0