Erpnext (Frappe) - vulnerabilities (CVEs)

132 CVEs, 68 in the last 30 days, 1725 known versions, newest CVE from 2026-10-16. Vendor: Frappe.

CVEs of Erpnext

CVE-2026-108373 - CVSS 6.5 (medium), 2026-10-16: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction…
CVE-2026-108374 - CVSS 7.7 (high), 2026-10-16: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce…
CVE-2026-109674 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote…
CVE-2026-109673 - CVSS 8.5 (high), 2026-10-12: Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not…
CVE-2026-109671 - CVSS 8.5 (high), 2026-10-12: Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without…
CVE-2026-109672 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109670 - CVSS 5.4 (medium), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without…
CVE-2026-109669 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109668 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing…
CVE-2026-109667 - CVSS 8.8 (high), 2026-10-12: Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type…
CVE-2026-109666 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109665 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109664 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records…
CVE-2026-109663 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints.…
CVE-2026-109662 - CVSS 6.1 (medium), 2026-10-12: Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts…
CVE-2026-109661 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109660 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify…
CVE-2026-109659 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109658 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109657 - CVSS 5.4 (medium), 2026-10-12: Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record…
CVE-2026-109656 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109655 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109654 - CVSS 5.4 (medium), 2026-10-12: Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the…
CVE-2026-109653 - CVSS 8.5 (high), 2026-10-12: Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML…
CVE-2026-109651 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by…
CVE-2026-109652 - CVSS 8.8 (high), 2026-10-12: Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not…
CVE-2026-109650 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109648 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.…
CVE-2026-109649 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing…
CVE-2026-109647 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation.…
CVE-2026-109645 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109646 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.…
CVE-2026-109644 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109642 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109643 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to…
CVE-2026-109641 - CVSS 6.9 (medium), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization…
CVE-2026-109640 - CVSS 8.1 (high), 2026-10-12: Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking…
CVE-2026-109639 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing…
CVE-2026-109638 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation.…
CVE-2026-109637 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted…
CVE-2026-109636 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper…
CVE-2026-109635 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to…
CVE-2026-109634 - CVSS 6.9 (medium), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.…
CVE-2026-109633 - CVSS 8.6 (high), 2026-10-12: Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing…
CVE-2026-109632 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109631 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted…
CVE-2026-109629 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through…
CVE-2026-109630 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109628 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role…
CVE-2026-109626 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with…
CVE-2026-109627 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109625 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based…
CVE-2026-109623 - CVSS 5.4 (medium), 2026-10-12: Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109624 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109622 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109621 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own…
CVE-2026-109617 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109616 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109615 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109614 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted…
CVE-2026-109613 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
CVE-2026-109612 - CVSS 8.5 (high), 2026-10-12: Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record…
CVE-2026-109611 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
CVE-2026-109610 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper…
CVE-2026-109609 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated…
CVE-2026-109608 - CVSS 8.8 (high), 2026-10-12: Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any…
CVE-2026-109604 - CVSS 8.5 (high), 2026-10-12: Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record…
CVE-2025-71432 - CVSS 8.6 (high), 2026-10-12: Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain…
CVE-2026-109376 - CVSS 5.3 (medium), 2026-10-12: ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view…
CVE-2026-109377 - CVSS 5.3 (medium), 2026-10-12: ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch…
CVE-2026-96672 - CVSS 6.4 (medium), 2026-09-23: Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing…
CVE-2026-94113 - CVSS 7.1 (high), 2026-09-20: Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail…
CVE-2026-65822 - CVSS 7.6 (high), 2026-08-17: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0,…
CVE-2026-65974 - CVSS 9.9 (critical), 2026-08-17: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission…
CVE-2026-72911 - CVSS 9.9 (critical), 2026-08-10: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in…
CVE-2026-72910 - CVSS 7.1 (high), 2026-08-10: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc,…
CVE-2026-72909 - CVSS 7.1 (high), 2026-08-10: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in…
CVE-2026-72908 - CVSS 6.5 (medium), 2026-08-10: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in…
CVE-2026-72907 - CVSS 6.5 (medium), 2026-08-10: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts…
CVE-2026-72906 - CVSS 4.3 (medium), 2026-08-10: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in…
CVE-2026-13227 - CVSS 7.1 (high), 2026-08-04: An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method…
CVE-2026-12895 - CVSS 7.1 (high), 2026-07-29: SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation…
CVE-2026-55242 - CVSS 8.8 (high), 2026-07-15: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can…
CVE-2026-42840 - CVSS 5.1 (medium), 2026-06-03: An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the…
CVE-2026-42839 - CVSS 4.8 (medium), 2026-06-03: An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an…
CVE-2026-44442 - CVSS 9.9 (critical), 2026-05-13: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks,…
CVE-2026-44447 - CVSS 8.8 (high), 2026-05-13: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially…
CVE-2026-44441 - CVSS 5 (medium), 2026-05-13: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an…
CVE-2026-44446 - CVSS 8.8 (high), 2026-05-13: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through…
CVE-2026-44440 - CVSS 6.5 (medium), 2026-05-13: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.101.1 and 16.10.0, an Improper Limitation of a Pathname to a Restricted…
CVE-2026-44445 - CVSS 6.5 (medium), 2026-05-13: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE)…
CVE-2026-44448 - CVSS 6.5 (medium), 2026-05-13: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization…
CVE-2026-38431 - CVSS 9.8 (critical), 2026-05-05: ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject…
CVE-2026-38432 - CVSS 6.1 (medium), 2026-05-05: ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email…
CVE-2023-54345 - CVSS 8.8 (high), 2026-05-05: Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to…
CVE-2026-31017 - CVSS 9.1 (critical), 2026-04-08: A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where…
CVE-2026-32954 - CVSS 7.5 (high), 2026-03-20: ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and…
CVE-2026-27471 - CVSS 9.3 (critical), 2026-02-21: ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access…
CVE-2025-65924 - CVSS 4.1 (medium), 2026-02-03: ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although…
CVE-2025-65923 - CVSS 5.4 (medium), 2026-02-03: A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing…