CVE Feed

    Dashboard / CVE / CVE-2023-54407

    CVE-2023-54407

    Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.

    Published:Oct 12, 2026
    Last Modified:Oct 14, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00306
    CVSS Score:4.9

    Affected Products

    Vendor
    Frappe
    Product
    Frappe

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-215 Fuzzing for application mapping

    Related CVEs

    CVE-2026-119145 (CVSS 9.4) — Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-up…
    CVE-2026-119144 (CVSS 8.7) — Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerabili…
    CVE-2026-114664 (CVSS 7.1) — Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.…
    CVE-2026-111388 (CVSS 5.3) — Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist f…
    CVE-2026-55823 (CVSS 8.7) — Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview compo…
    CVE-2026-66057 (CVSS 5.1) — Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an …
    CVE-2026-109603 (CVSS 4.8) — Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-…
    CVE-2026-109602 (CVSS 5.1) — Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboa…
    CVE-2026-109601 (CVSS 7.1) — Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the …
    CVE-2026-109600 (CVSS 6.9) — Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled bef…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High