Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.14.0 and 15.104.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35614 Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.14.0 and… https://www.cve.org/CVERecord?id=CVE-2026-35614
Post summary
A SQL injection flaw was found in Frappe’s bulk_update method affecting versions before 16.14.0 and 15.104.0; the issue has been fixed in the listed releases.
🚨 CVE-2026-35614: Frappe has a SQL injection in bu... Unauthenticated SQLi in Frappe's bulk_update function = instant database takeover for thousands of ERPNext deployments ... https://zerodaysignal.com/vulnerability/CVE-2026-35614 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-35614, an unauthenticated SQL injection in Frappe's bulk_update function that could enable immediate database takeover on thousands of ERPNext deployments, and links to a vulnerability page for details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | frappe | frappe | - | - | - |