Skip to contentFrappe Erpnext vulnerabilities
- frappe erpnextFrappe ERPNext before 15.121.3 Missing Authorization in Transactional Email EndpointCVE-2026-1096295.3 Medium
- frappe erpnextERPNext: Unauthorised status modification due to missing validationCVE-2026-1083747.7 High
- frappe erpnextFrappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing AuthorizationCVE-2026-1096287.1 High
- frappe erpnextFrappe ERPNext before 15.120.0 Missing Authorization Exposes Financial DataCVE-2026-1096277.1 High
- frappe erpnextFrappe ERPNext before 16.34.2 SQL Injection via Multiple EndpointsCVE-2026-1096267.1 High
- frappe erpnextFrappe ERPNext before 15.121.3 Missing Authorization Exposes Financial DataCVE-2026-1096257.1 High
- frappe erpnextFrappe ERPNext before 15.120.0 Missing Authorization Exposes Personal DataCVE-2026-1096247.1 High
- frappe erpnextFrappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing AuthorizationCVE-2026-1096235.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing AuthorizationCVE-2026-1096225.3 Medium
- frappe erpnextFrappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission BypassCVE-2026-1096217.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Record Creation EndpointsCVE-2026-1096177.1 High
- frappe erpnextFrappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data ModificationCVE-2026-1096167.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Document Creation EndpointsCVE-2026-1096157.1 High
- frappe erpnextFrappe ERPNext before 16.34.0 Missing Authorization Exposes Financial DataCVE-2026-1096147.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status ModificationCVE-2026-1096137.1 High
- frappe erpnextFrappe ERPNext before 15.120.0 Stored XSS via Report ViewCVE-2026-1096128.5 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Certain EndpointsCVE-2026-1096115.3 Medium
- frappe erpnextFrappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document ModificationCVE-2026-1096107.1 High
- frappe erpnextFrappe ERPNext before 15.119.1 SQL Injection via Missing Input ValidationCVE-2026-1096097.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint InputCVE-2026-1096088.7 High
- frappe erpnextERPNext before 15.112.0 Stored XSS via Tool View Record NamesCVE-2026-1096048.5 High
- frappe erpnextFrappe ERPNext before 15.83.0 Reflected XSS Leading to Account TakeoverCVE-2025-714328.6 High
- frappe erpnextERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup MethodsCVE-2026-1093775.3 Medium
- frappe erpnextERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_htmlCVE-2026-1093765.3 Medium
- frappe erpnextFrappe ERPNext before 16.34.1 Unauthorized Method InvocationCVE-2026-966725.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet EndpointsCVE-2026-941137.1 High
- frappe erpnextERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filterCVE-2026-658227.6 High
- frappe erpnextERPNext: Server-Side Template Injection leading to Remote Code ExecutionCVE-2026-659749.9 Critical
- frappe erpnextERPNext: Possibility of server-side template injection due to missing validationCVE-2026-729119.9 Critical
- frappe erpnextERPNext: Unauthorised modification of master data due to missing validationCVE-2026-729107.1 High
- frappe erpnextERPNext: Broken Access Control on certain endpointsCVE-2026-729097.1 High
- frappe erpnextERPNext: Possibility of SQL injection due to missing validationCVE-2026-729086.5 Medium
- frappe erpnextERPNext: Broken Access Control on certain endpointCVE-2026-729076.5 Medium
- frappe erpnextERPNext: Unauthorised triggering of automated emails due to missing validationCVE-2026-729064.3 Medium
- frappe erpnextERPNext v16.25.0 - Improper authorization in Prospect opportunities APICVE-2026-132277.1 High
- frappe erpnextSQL Injection in Frappe's ERPNextCVE-2026-128957.1 High
- frappe erpnextERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefixCVE-2026-552428.8 High
- frappe erpnextERPNext 16.16.0 - Stored XSS in POS cart item renderingCVE-2026-428394.8 Medium
- frappe erpnextERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literalsCVE-2026-428405.1 Medium
- frappe erpnextERPNext: Unauthorised Document modification due to missing validationCVE-2026-444485.9 Medium
- frappe erpnextERPNext: Possibility of SQL Injection due to missing validationCVE-2026-444478.8 High
- frappe erpnextERPNext: Possibility of SQL Injection due to missing validationCVE-2026-444468.8 High
- frappe erpnextERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI ModuleCVE-2026-444455.3 Medium
- frappe erpnextERPNext: Possible SSRF by any authenticated userCVE-2026-444415.0 Medium
- frappe erpnextERPNext: Path Traversal Leading to Sensitive File ExposureCVE-2026-444406.5 Medium
- frappe erpnextERPNext: Unauthorised Document modification due to missing validationCVE-2026-444429.9 Critical
- frappe erpnext, erpnext frappe framework (erpnext), frappe technologies framework (erpnext) +2 moreFrappe Framework ERPNext 13.4.0 Remote Code ExecutionCVE-2023-543458.7 High
- frappe erpnextERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template...CVE-2026-384326.1 Medium
- frappe erpnextERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker...CVE-2026-384319.8 Critical
- frappe erpnext, frappe +1 moreA Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of...CVE-2026-310179.1 Critical
- Show moreLoading…