← Database

CVE-2026-35614

CRITICAL CVSS: 9.8 Published: 2026-04-07 Modified: 2026-06-17

Description

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.14.0 and 15.104.0.

Affected Platforms

Frappe Frappe

Weakness Type

CWE-89

References