CVE-2026-114664 | Frappe Framework up to 16.32.x Event event.py frappe.desk.doctype.event.event.get_events sql injection

October 22, 2026 Yanac

A vulnerability labeled as critical has been found in Frappe Framework up to 16.32.x. The affected element is the function frappe.desk.doctype.event.event.get_events of the file frappe/desk/doctype/event/event.py of the component Event. Executing a manipulation can lead to sql injection.

The identification of this vulnerability is CVE-2026-114664. The attack may be launched remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More