Advisories · Technology

frappe erpnext.

Every CVE that names frappe erpnext among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-108373 CVE record

CVSS 6.5 Medium

ERPNext: Unauthorised access to financial data due to missing validation
- frappe erpnext
- Broken access control
Not analysed yet 16 Oct 2026
CVE-2026-108374 CVE record

CVSS 7.7 High

ERPNext: Unauthorised status modification due to missing validation
- frappe erpnext
- Broken access control
Not analysed yet 16 Oct 2026
CVE-2026-109674 CVE record

CVSS 7.1 High

Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109673 CVE record

CVSS 8.5 High

Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109672 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109671 CVE record

CVSS 8.5 High

Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109670 CVE record

CVSS 5.1 Medium

Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109669 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109668 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109667 CVE record

CVSS 8.7 High

Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
- frappe erpnext
- Privilege escalation
Not analysed yet 12 Oct 2026
CVE-2026-109666 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109665 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109664 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109663 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109662 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109661 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109660 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109659 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109658 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109657 CVE record

CVSS 5.1 Medium

Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109656 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109655 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109654 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109653 CVE record

CVSS 8.5 High

Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109652 CVE record

CVSS 8.7 High

Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
- frappe erpnext
- Code injection
Not analysed yet 12 Oct 2026
CVE-2026-109651 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
- frappe erpnext
- Server-side request forgery (SSRF)
Not analysed yet 12 Oct 2026
CVE-2026-109650 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109649 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109648 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109647 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109646 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109645 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109644 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109643 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109642 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109641 CVE record

CVSS 6.9 Medium

Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109640 CVE record

CVSS 7.2 High

Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109639 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109638 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109637 CVE record

CVSS 7.1 High

Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109636 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109635 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109634 CVE record

CVSS 6.9 Medium

Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109633 CVE record

CVSS 8.6 High

Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109632 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109631 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109630 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109629 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109628 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109627 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109626 CVE record

CVSS 7.1 High

Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints
- frappe erpnext
- SQL injection
Not analysed yet 12 Oct 2026
CVE-2026-109625 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109624 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109623 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109622 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109621 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109617 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109616 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109615 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109614 CVE record

CVSS 7.1 High

Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026