# frappe erpnext.

Every CVE that names frappe erpnext among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [ERPNext: Unauthorised access to financial data due to missing validation](https://agentprime.io/advisories/CVE-2026-108373.md)
  `CVE-2026-108373` · CVE record: frappe erpnext · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [ERPNext: Unauthorised status modification due to missing validation](https://agentprime.io/advisories/CVE-2026-108374.md)
  `CVE-2026-108374` · CVE record: frappe erpnext · CVSS 7.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation](https://agentprime.io/advisories/CVE-2026-109674.md)
  `CVE-2026-109674` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names](https://agentprime.io/advisories/CVE-2026-109673.md)
  `CVE-2026-109673` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109672.md)
  `CVE-2026-109672` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages](https://agentprime.io/advisories/CVE-2026-109671.md)
  `CVE-2026-109671` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name](https://agentprime.io/advisories/CVE-2026-109670.md)
  `CVE-2026-109670` · CVE record: frappe erpnext · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification](https://agentprime.io/advisories/CVE-2026-109669.md)
  `CVE-2026-109669` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints](https://agentprime.io/advisories/CVE-2026-109668.md)
  `CVE-2026-109668` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation](https://agentprime.io/advisories/CVE-2026-109667.md)
  `CVE-2026-109667` · CVE record: frappe erpnext · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation
- [Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints](https://agentprime.io/advisories/CVE-2026-109666.md)
  `CVE-2026-109666` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation](https://agentprime.io/advisories/CVE-2026-109665.md)
  `CVE-2026-109665` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification](https://agentprime.io/advisories/CVE-2026-109664.md)
  `CVE-2026-109664` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters](https://agentprime.io/advisories/CVE-2026-109663.md)
  `CVE-2026-109663` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form](https://agentprime.io/advisories/CVE-2026-109662.md)
  `CVE-2026-109662` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109661.md)
  `CVE-2026-109661` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints](https://agentprime.io/advisories/CVE-2026-109660.md)
  `CVE-2026-109660` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109659.md)
  `CVE-2026-109659` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints](https://agentprime.io/advisories/CVE-2026-109658.md)
  `CVE-2026-109658` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name](https://agentprime.io/advisories/CVE-2026-109657.md)
  `CVE-2026-109657` · CVE record: frappe erpnext · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access](https://agentprime.io/advisories/CVE-2026-109656.md)
  `CVE-2026-109656` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints](https://agentprime.io/advisories/CVE-2026-109655.md)
  `CVE-2026-109655` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints](https://agentprime.io/advisories/CVE-2026-109654.md)
  `CVE-2026-109654` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover](https://agentprime.io/advisories/CVE-2026-109653.md)
  `CVE-2026-109653` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields](https://agentprime.io/advisories/CVE-2026-109652.md)
  `CVE-2026-109652` · CVE record: frappe erpnext · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Code injection
- [Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field](https://agentprime.io/advisories/CVE-2026-109651.md)
  `CVE-2026-109651` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data](https://agentprime.io/advisories/CVE-2026-109650.md)
  `CVE-2026-109650` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests](https://agentprime.io/advisories/CVE-2026-109649.md)
  `CVE-2026-109649` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation](https://agentprime.io/advisories/CVE-2026-109648.md)
  `CVE-2026-109648` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation](https://agentprime.io/advisories/CVE-2026-109647.md)
  `CVE-2026-109647` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation](https://agentprime.io/advisories/CVE-2026-109646.md)
  `CVE-2026-109646` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization](https://agentprime.io/advisories/CVE-2026-109645.md)
  `CVE-2026-109645` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data](https://agentprime.io/advisories/CVE-2026-109644.md)
  `CVE-2026-109644` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data](https://agentprime.io/advisories/CVE-2026-109643.md)
  `CVE-2026-109643` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints](https://agentprime.io/advisories/CVE-2026-109642.md)
  `CVE-2026-109642` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints](https://agentprime.io/advisories/CVE-2026-109641.md)
  `CVE-2026-109641` · CVE record: frappe erpnext · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification](https://agentprime.io/advisories/CVE-2026-109640.md)
  `CVE-2026-109640` · CVE record: frappe erpnext · CVSS 7.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests](https://agentprime.io/advisories/CVE-2026-109639.md)
  `CVE-2026-109639` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation](https://agentprime.io/advisories/CVE-2026-109638.md)
  `CVE-2026-109638` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification](https://agentprime.io/advisories/CVE-2026-109637.md)
  `CVE-2026-109637` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109636.md)
  `CVE-2026-109636` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints](https://agentprime.io/advisories/CVE-2026-109635.md)
  `CVE-2026-109635` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints](https://agentprime.io/advisories/CVE-2026-109634.md)
  `CVE-2026-109634` · CVE record: frappe erpnext · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page](https://agentprime.io/advisories/CVE-2026-109633.md)
  `CVE-2026-109633` · CVE record: frappe erpnext · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints](https://agentprime.io/advisories/CVE-2026-109632.md)
  `CVE-2026-109632` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation](https://agentprime.io/advisories/CVE-2026-109631.md)
  `CVE-2026-109631` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints](https://agentprime.io/advisories/CVE-2026-109630.md)
  `CVE-2026-109630` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint](https://agentprime.io/advisories/CVE-2026-109629.md)
  `CVE-2026-109629` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization](https://agentprime.io/advisories/CVE-2026-109628.md)
  `CVE-2026-109628` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109627.md)
  `CVE-2026-109627` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints](https://agentprime.io/advisories/CVE-2026-109626.md)
  `CVE-2026-109626` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109625.md)
  `CVE-2026-109625` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data](https://agentprime.io/advisories/CVE-2026-109624.md)
  `CVE-2026-109624` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization](https://agentprime.io/advisories/CVE-2026-109623.md)
  `CVE-2026-109623` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization](https://agentprime.io/advisories/CVE-2026-109622.md)
  `CVE-2026-109622` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass](https://agentprime.io/advisories/CVE-2026-109621.md)
  `CVE-2026-109621` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints](https://agentprime.io/advisories/CVE-2026-109617.md)
  `CVE-2026-109617` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification](https://agentprime.io/advisories/CVE-2026-109616.md)
  `CVE-2026-109616` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints](https://agentprime.io/advisories/CVE-2026-109615.md)
  `CVE-2026-109615` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109614.md)
  `CVE-2026-109614` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control

Older: <https://agentprime.io/advisories/technology/frappe-erpnext.md?cursor=WyIyMDI2LTEwLTEyVDIyOjIyOjAxLjExMDAwMFoiLCJDVkUtMjAyNi0xMDk2MTQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=frappe-erpnext>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/frappe-erpnext/>. Everything for agents: <https://agentprime.io/llms.txt>.