Skip to contentFrappe Erpnext vulnerabilities
- frappe erpnextERP has a possibility SQL Injection vulnerability due to missing validationCVE-2026-329547.1 High
- frappe erpnextERP: Document access through endpoints due to missing validationCVE-2026-274719.3 Critical
- frappe erpnextERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks...CVE-2025-659244.1 Medium
- frappe erpnextA Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism...CVE-2025-659235.4 Medium
- frappe, frappe erpnext +1 moreAn arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0...CVE-2025-672899.6 Critical
- frappe erpnextAn issue was discovered in Frappe ERPNext through 15.89.0. Function...CVE-2025-664408.8 High
- frappe erpnextAn issue was discovered in Frappe ERPNext through 15.89.0. Function...CVE-2025-664398.8 High
- frappe erpnextA Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89...CVE-2025-664388.8 High
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method...CVE-2025-664378.8 High
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions...CVE-2025-664364.3 Medium
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method...CVE-2025-664354.3 Medium
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text...CVE-2025-664348.8 High
- frappe erpnext, frappe +1 moreIn ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar...CVE-2025-652679.0 Critical
- frappe erpnext, frappe +1 moreERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api...CVE-2025-56381Public exploit6.5 Medium
- frappe, frappe erpnext +1 moreFrappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the...CVE-2025-56380Public exploit6.5 Medium
- frappe erpnext, frappe +1 moreA stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0...CVE-2025-56379Public exploit5.4 Medium
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype...CVE-2025-520428.2 High
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype...CVE-2025-520418.2 High
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by in…CVE-2025-520408.2 High
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext...CVE-2025-520398.2 High
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext...CVE-2025-520506.5 Medium
- frappe erpnextIn Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype...CVE-2025-520496.5 Medium
- frappe erpnextIn Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py...CVE-2025-520476.5 Medium
- frappe erpnextIn Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype...CVE-2025-520436.5 Medium
- frappe erpnextIn Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is...CVE-2025-520447.5 High
- frappe erpnextERP: Possibility of SQL injection due to missing validationCVE-2025-584398.1 High
- frappe erpnextA Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3....CVE-2025-28062Public exploit8.1 High
- frappe erpnextFrappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly...CVE-2022-28598Public exploit6.1 Medium
- frappe erpnext, elated-themes frappe +1 moreERPNext - Improper user access conrolCVE-2022-230555.5 Medium
- frappe erpnext, elated-themes frappe +1 moreERPNext - Stored XSS in My SettingsCVE-2022-230583.5 Low
- erpnextERPNext - Stored XSS leads to account takoverCVE-2022-230563.5 Low
- frappe erpnext, elated-themes frappe +1 moreERPNext - Stored XSS in My ProfileCVE-2022-230575.4 Medium
- frappe erpnextAn SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext...CVE-2020-61456.4 Medium
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.CVE-2019-205217.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.CVE-2019-205207.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a...CVE-2019-205197.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.CVE-2019-205187.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.CVE-2019-205177.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.CVE-2019-205167.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.CVE-2019-205157.4 High
- frappe erpnextERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.CVE-2019-205147.4 High
- frappe erpnextERPNext 11.1.47 allows blog?blog_category= Frame Injection.CVE-2019-205114.7 Medium
- frappe erpnextA SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack...CVE-2018-200617.5 High
- frappe erpnextAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6....CVE-2018-38855.4 Medium
- frappe erpnextAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6....CVE-2018-38845.4 Medium
- frappe erpnextAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6....CVE-2018-38835.4 Medium
- frappe erpnextAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6....CVE-2018-38825.4 Medium
- frappe erpnextAn XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.CVE-2018-11339Public exploit6.1 Medium