What is GHSA-9hf7-jg6j-3g9q?

GHSA-9hf7-jg6j-3g9q is a security advisory published by GitHub Security Advisories with High severity. Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk...

Which CVE IDs does GHSA-9hf7-jg6j-3g9q cover?

GHSA-9hf7-jg6j-3g9q covers the following CVE IDs: CVE-2026-114664. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9hf7-jg6j-3g9q?

GHSA-9hf7-jg6j-3g9q has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-9hf7-jg6j-3g9qHighCVSS 7.1

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-114664 →

📋 Description

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.

🔗 References (4)

https://github.com/frappe/frappe/security/advisories/GHSA-p4w2-9mr5-6prj
https://nvd.nist.gov/vuln/detail/CVE-2026-114664
https://www.vulncheck.com/advisories/frappe-before-16.33.0-blind-sql-injection-via-get-events
https://github.com/advisories/GHSA-9hf7-jg6j-3g9q