Medium severityNVD Advisory· Published Jun 12, 2026· Updated Jun 12, 2026

CVE-2026-41581

Description

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has been patched in versions 15.106.0 and 16.16.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Frappeinferred2 versions
<15.106.0 || >=16.0,<16.16.0+ 1 more
- (no CPE)range: <15.106.0 || >=16.0,<16.16.0
- (no CPE)range: <15.106.0, <16.16.0

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/security/advisories/GHSA-h9hf-57r4-cm65nvd

News mentions

Frappe: 11 Medium-Severity CVEs Disclosed in a Single Day — XSS, SQLi, IDOR, and Access-Control Bugs
Vypr Intelligence · Jun 12, 2026

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000