# frappe erpnext.

Every CVE that names frappe erpnext among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification](https://agentprime.io/advisories/CVE-2026-109613.md)
  `CVE-2026-109613` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.120.0 Stored XSS via Report View](https://agentprime.io/advisories/CVE-2026-109612.md)
  `CVE-2026-109612` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints](https://agentprime.io/advisories/CVE-2026-109611.md)
  `CVE-2026-109611` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification](https://agentprime.io/advisories/CVE-2026-109610.md)
  `CVE-2026-109610` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation](https://agentprime.io/advisories/CVE-2026-109609.md)
  `CVE-2026-109609` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input](https://agentprime.io/advisories/CVE-2026-109608.md)
  `CVE-2026-109608` · CVE record: frappe erpnext · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [ERPNext before 15.112.0 Stored XSS via Tool View Record Names](https://agentprime.io/advisories/CVE-2026-109604.md)
  `CVE-2026-109604` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover](https://agentprime.io/advisories/CVE-2025-71432.md)
  `CVE-2025-71432` · CVE record: frappe erpnext · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods](https://agentprime.io/advisories/CVE-2026-109377.md)
  `CVE-2026-109377` · CVE record: Frappe ERPNext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html](https://agentprime.io/advisories/CVE-2026-109376.md)
  `CVE-2026-109376` · CVE record: Frappe ERPNext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 16.34.1 Unauthorized Method Invocation](https://agentprime.io/advisories/CVE-2026-96672.md)
  `CVE-2026-96672` · CVE record: Frappe ERPNext · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints](https://agentprime.io/advisories/CVE-2026-94113.md)
  `CVE-2026-94113` · CVE record: Frappe ERPNext · CVSS 7.1 High · Not analysed yet · Published 20 Sept 2026 · Tags: Broken access control
- [ERPNext: SQL Injection in "Inactive Customers" report via unvalidated \`doctype\` filter](https://agentprime.io/advisories/CVE-2026-65822.md)
  `CVE-2026-65822` · CVE record: frappe erpnext · CVSS 7.6 High · Not analysed yet · Published 17 Aug 2026 · Tags: SQL injection
- [ERPNext: Server-Side Template Injection leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-65974.md)
  `CVE-2026-65974` · CVE record: frappe erpnext · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: Code injection
- [ERPNext: Possibility of server-side template injection due to missing validation](https://agentprime.io/advisories/CVE-2026-72911.md)
  `CVE-2026-72911` · CVE record: frappe erpnext · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Code injection
- [ERPNext: Unauthorised modification of master data due to missing validation](https://agentprime.io/advisories/CVE-2026-72910.md)
  `CVE-2026-72910` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control
- [ERPNext: Broken Access Control on certain endpoints](https://agentprime.io/advisories/CVE-2026-72909.md)
  `CVE-2026-72909` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control
- [ERPNext: Possibility of SQL injection due to missing validation](https://agentprime.io/advisories/CVE-2026-72908.md)
  `CVE-2026-72908` · CVE record: frappe erpnext · CVSS 6.5 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: SQL injection
- [ERPNext: Broken Access Control on certain endpoint](https://agentprime.io/advisories/CVE-2026-72907.md)
  `CVE-2026-72907` · CVE record: frappe erpnext · CVSS 6.5 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control
- [ERPNext: Unauthorised triggering of automated emails due to missing validation](https://agentprime.io/advisories/CVE-2026-72906.md)
  `CVE-2026-72906` · CVE record: frappe erpnext · CVSS 4.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control
- [ERPNext v16.25.0 - Improper authorization in Prospect opportunities API](https://agentprime.io/advisories/CVE-2026-13227.md)
  `CVE-2026-13227` · CVE record: Frappe ERPNext · CVSS 7.1 High · Not analysed yet · Published 4 Aug 2026 · Tags: Broken access control
- [SQL Injection in Frappe's ERPNext](https://agentprime.io/advisories/CVE-2026-12895.md)
  `CVE-2026-12895` · CVE record: Frappe ERPNext · CVSS 7.1 High · Not analysed yet · Published 29 Jul 2026 · Tags: SQL injection
- [ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix](https://agentprime.io/advisories/CVE-2026-55242.md)
  `CVE-2026-55242` · CVE record: frappe erpnext · CVSS 8.8 High · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control, Code injection
- [ERPNext 16.16.0 - Stored XSS in POS cart item rendering](https://agentprime.io/advisories/CVE-2026-42839.md)
  `CVE-2026-42839` · CVE record: Frappe ERPNext · CVSS 4.8 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Cross-site scripting (XSS)
- [ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals](https://agentprime.io/advisories/CVE-2026-42840.md)
  `CVE-2026-42840` · CVE record: Frappe ERPNext · CVSS 5.1 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Cross-site scripting (XSS)
- [ERPNext: Unauthorised Document modification due to missing validation](https://agentprime.io/advisories/CVE-2026-44448.md)
  `CVE-2026-44448` · CVE record: frappe erpnext · CVSS 5.9 Medium · Not analysed yet · Published 13 May 2026 · Tags: Broken access control
- [ERPNext: Possibility of SQL Injection due to missing validation](https://agentprime.io/advisories/CVE-2026-44447.md)
  `CVE-2026-44447` · CVE record: frappe erpnext · CVSS 8.8 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [ERPNext: Possibility of SQL Injection due to missing validation](https://agentprime.io/advisories/CVE-2026-44446.md)
  `CVE-2026-44446` · CVE record: frappe erpnext · CVSS 8.8 High · Not analysed yet · Published 13 May 2026 · Tags: SQL injection
- [ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module](https://agentprime.io/advisories/CVE-2026-44445.md)
  `CVE-2026-44445` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2026 · Tags: XML external entities (XXE)
- [ERPNext: Possible SSRF by any authenticated user](https://agentprime.io/advisories/CVE-2026-44441.md)
  `CVE-2026-44441` · CVE record: frappe erpnext · CVSS 5.0 Medium · Not analysed yet · Published 13 May 2026 · Tags: Server-side request forgery (SSRF)
- [ERPNext: Path Traversal Leading to Sensitive File Exposure](https://agentprime.io/advisories/CVE-2026-44440.md)
  `CVE-2026-44440` · CVE record: frappe erpnext · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2026 · Tags: Path traversal
- [ERPNext: Unauthorised Document modification due to missing validation](https://agentprime.io/advisories/CVE-2026-44442.md)
  `CVE-2026-44442` · CVE record: frappe erpnext · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Broken access control
- [ERP has a possibility SQL Injection vulnerability due to missing validation](https://agentprime.io/advisories/CVE-2026-32954.md)
  `CVE-2026-32954` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 20 Mar 2026 · Tags: SQL injection
- [ERP: Document access through endpoints due to missing validation](https://agentprime.io/advisories/CVE-2026-27471.md)
  `CVE-2026-27471` · CVE record: frappe erpnext · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2026 · Tags: Broken access control, Authentication bypass
- [ERP: Possibility of SQL injection due to missing validation](https://agentprime.io/advisories/CVE-2025-58439.md)
  `CVE-2025-58439` · CVE record: frappe erpnext · CVSS 8.1 High · Not analysed yet · Published 6 Sept 2025 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/technology/frappe-erpnext.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=frappe-erpnext&cursor=WyIyMDI2LTEwLTEyVDIyOjIyOjAxLjExMDAwMFoiLCJDVkUtMjAyNi0xMDk2MTQiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/frappe-erpnext/?cursor=WyIyMDI2LTEwLTEyVDIyOjIyOjAxLjExMDAwMFoiLCJDVkUtMjAyNi0xMDk2MTQiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.