CVE-2019-14965: Frappe

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists.

Affected products

• Frappe Frappe: from 10.0.0, before 12.0.4 (fixed in 12.0.4)

Published 2019-08-12. Last modified 2026-06-17.