Skip to contentFrappe Erpnext vulnerabilities
- frappe erpnextFrappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requestsCVE-2026-1243165.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_itemsCVE-2026-1243157.1 High
- frappe erpnextFrappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activitiesCVE-2026-1243147.1 High
- frappe erpnextFrappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_docCVE-2026-1243135.3 Medium
- frappe erpnextFrappe ERPNext before 16.6.0 SQL Injection via Missing Input ValidationCVE-2026-1096747.1 High
- frappe erpnextFrappe ERPNext before 16.12.0 Stored XSS via Crafted Record NamesCVE-2026-1096738.5 High
- frappe erpnextERPNext: Unauthorised access to financial data due to missing validationCVE-2026-1083736.5 Medium
- frappe erpnextFrappe ERPNext before 15.118.0 Missing Authorization Exposes Financial DataCVE-2026-1096727.1 High
- frappe erpnextFrappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal PagesCVE-2026-1096718.5 High
- frappe erpnextFrappe ERPNext before 15.110.0 Stored XSS via Item Record NameCVE-2026-1096705.1 Medium
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status ModificationCVE-2026-1096695.3 Medium
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Party Record EndpointsCVE-2026-1096685.3 Medium
- frappe erpnextFrappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record CreationCVE-2026-1096678.7 High
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Inventory Record EndpointsCVE-2026-1096667.1 High
- frappe erpnextFrappe ERPNext before 15.108.0 Missing Authorization Allows Master Record DeactivationCVE-2026-1096655.3 Medium
- frappe erpnextFrappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record ModificationCVE-2026-1096645.3 Medium
- frappe erpnextFrappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint ParametersCVE-2026-1096637.1 High
- frappe erpnextFrappe ERPNext before 15.112.0 Stored XSS via Public Portal FormCVE-2026-1096625.3 Medium
- frappe erpnextFrappe ERPNext before 15.116.0 Missing Authorization Exposes Financial DataCVE-2026-1096617.1 High
- frappe erpnextFrappe ERPNext before 15.112.0 Missing Authorization in Production Record EndpointsCVE-2026-1096607.1 High
- frappe erpnextFrappe ERPNext before 15.113.0 Missing Authorization Exposes Financial DataCVE-2026-1096597.1 High
- frappe erpnextFrappe ERPNext before 15.115.0 Missing Authorization on EndpointsCVE-2026-1096587.1 High
- frappe erpnextFrappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record NameCVE-2026-1096575.1 Medium
- frappe erpnextFrappe ERPNext before 15.118.2 Unauthorized Item Master Data AccessCVE-2026-1096567.1 High
- frappe erpnextFrappe ERPNext before 15.115.0 Missing Authorization in Inventory EndpointsCVE-2026-1096557.1 High
- frappe erpnextFrappe ERPNext before 15.119.0 Missing Authorization in Transactional Email EndpointsCVE-2026-1096545.3 Medium
- frappe erpnextFrappe ERPNext before 15.119.0 Stored XSS Leading to Account TakeoverCVE-2026-1096538.5 High
- frappe erpnextFrappe ERPNext before 15.119.1 Server-Side Template Injection via Message FieldsCVE-2026-1096528.7 High
- frappe erpnextFrappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration FieldCVE-2026-1096515.3 Medium
- frappe erpnextFrappe ERPNext before 15.112.0 Missing Authorization Exposes Personal DataCVE-2026-1096507.1 High
- frappe erpnextFrappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint RequestsCVE-2026-1096497.1 High
- frappe erpnextFrappe ERPNext before 15.106.0 SQL Injection via Missing Input ValidationCVE-2026-1096487.1 High
- frappe erpnextFrappe ERPNext before 15.106.0 SQL Injection via Missing ValidationCVE-2026-1096477.1 High
- frappe erpnextFrappe ERPNext before 15.106.0 SQL Injection via Missing ValidationCVE-2026-1096467.1 High
- frappe erpnextFrappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing AuthorizationCVE-2026-1096457.1 High
- frappe erpnextFrappe ERPNext before 15.119.0 Unauthorized Access to Valuation DataCVE-2026-1096447.1 High
- frappe erpnextFrappe ERPNext before 15.111.0 Missing Authorization Exposes Project DataCVE-2026-1096437.1 High
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Certain EndpointsCVE-2026-1096425.3 Medium
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Record Creation EndpointsCVE-2026-1096416.9 Medium
- frappe erpnextFrappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record ModificationCVE-2026-1096407.2 High
- frappe erpnextFrappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint RequestsCVE-2026-1096397.1 High
- frappe erpnextFrappe ERPNext before 15.110.0 SQL Injection via Missing Input ValidationCVE-2026-1096387.1 High
- frappe erpnextFrappe ERPNext before 16.14.0 Missing Authorization Allows Master Data ModificationCVE-2026-1096377.1 High
- frappe erpnextFrappe ERPNext before 15.115.0 Missing Authorization Exposes Financial DataCVE-2026-1096367.1 High
- frappe erpnextFrappe ERPNext before 15.105.0 Missing Authorization in Document Creation EndpointsCVE-2026-1096355.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated EndpointsCVE-2026-1096346.9 Medium
- frappe erpnextFrappe ERPNext before 15.119.1 Stored XSS via Public Booking PageCVE-2026-1096338.6 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization on Certain EndpointsCVE-2026-1096327.1 High
- frappe erpnextFrappe ERPNext before 15.119.1 SQL Injection via Missing ValidationCVE-2026-1096317.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in EndpointsCVE-2026-1096305.3 Medium
- Show olderLoading…