Advisories · Technology
frappe erpnext.
Every CVE that names frappe erpnext among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification
- frappe erpnext
- Broken access control
- CVSS 8.5 High
Frappe ERPNext before 15.120.0 Stored XSS via Report View
- frappe erpnext
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints
- frappe erpnext
- Broken access control
- CVSS 7.1 High
Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification
- frappe erpnext
- Broken access control
- CVSS 7.1 High
Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation
- frappe erpnext
- SQL injection
- CVSS 8.7 High
Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input
- frappe erpnext
- SQL injection
- CVSS 8.5 High
ERPNext before 15.112.0 Stored XSS via Tool View Record Names
- frappe erpnext
- Cross-site scripting (XSS)
- CVSS 8.6 High
Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover
- frappe erpnext
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods
- Frappe ERPNext
- Broken access control
- CVSS 5.3 Medium
ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html
- Frappe ERPNext
- Broken access control
- CVSS 5.3 Medium
Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
- Frappe ERPNext
- Code injection
- CVSS 7.1 High
Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints
- Frappe ERPNext
- Broken access control
- CVSS 7.6 High
ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter
- frappe erpnext
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
ERPNext: Server-Side Template Injection leading to Remote Code Execution
- frappe erpnext
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
ERPNext: Possibility of server-side template injection due to missing validation
- frappe erpnext
- Code injection
- CVSS 7.1 High
ERPNext: Unauthorised modification of master data due to missing validation
- frappe erpnext
- Broken access control
- CVSS 7.1 High
ERPNext: Broken Access Control on certain endpoints
- frappe erpnext
- Broken access control
- CVSS 6.5 Medium
ERPNext: Possibility of SQL injection due to missing validation
- frappe erpnext
- SQL injection
- CVSS 6.5 Medium
ERPNext: Broken Access Control on certain endpoint
- frappe erpnext
- Broken access control
- CVSS 4.3 Medium
ERPNext: Unauthorised triggering of automated emails due to missing validation
- frappe erpnext
- Broken access control
- CVSS 7.1 High
ERPNext v16.25.0 - Improper authorization in Prospect opportunities API
- Frappe ERPNext
- Broken access control
- CVSS 7.1 High
SQL Injection in Frappe's ERPNext
- Frappe ERPNext
- SQL injection
- CVSS 8.8 High
ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix
- frappe erpnext
- Broken access control
- Code injection
- CVSS 4.8 Medium
ERPNext 16.16.0 - Stored XSS in POS cart item rendering
- Frappe ERPNext
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals
- Frappe ERPNext
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
ERPNext: Unauthorised Document modification due to missing validation
- frappe erpnext
- Broken access control
- CVSS 8.8 High
ERPNext: Possibility of SQL Injection due to missing validation
- frappe erpnext
- SQL injection
- CVSS 8.8 High
ERPNext: Possibility of SQL Injection due to missing validation
- frappe erpnext
- SQL injection
- CVSS 5.3 Medium
ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module
- frappe erpnext
- XML external entities (XXE)
- CVSS 5.0 Medium
ERPNext: Possible SSRF by any authenticated user
- frappe erpnext
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
ERPNext: Path Traversal Leading to Sensitive File Exposure
- frappe erpnext
- Path traversal
- CVSS 9.9 CriticalCritical · CVSS 9+
ERPNext: Unauthorised Document modification due to missing validation
- frappe erpnext
- Broken access control
- CVSS 7.1 High
ERP has a possibility SQL Injection vulnerability due to missing validation
- frappe erpnext
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
ERP: Document access through endpoints due to missing validation
- frappe erpnext
- Broken access control
- Authentication bypass
- CVSS 8.1 High
ERP: Possibility of SQL injection due to missing validation
- frappe erpnext
- SQL injection