Login Request a demo
ER
Product
erpnext
by frappe · last CVE Oct 16, 2026
144
CVEs
0
On KEV
9.9
Max CVSS
70
New 30D
Vulnerabilities144In the news0Timeline
Severity mix
Critical 9High 42Medium 90Low 0
Severity
All severities144Critical9High42Medium90Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add erpnext to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-65974
9.9
1%
Aug 17
ERPNext: Server-Side Template Injection leading to Remote Code Execution
Affected: < 15.111.0; >= 16.0.0, < 16.22.0
CVE-2026-72911
9.9
1%
Aug 10
ERPNext: Possibility of server-side template injection due to missing validation
Affected: < 15.118.0; >= 16.0.0, < 16.29.0
CVE-2026-44442
9.9
0%
May 13
ERPNext: Unauthorised Document modification due to missing validation
Affected: < 16.9.1
CVE-2026-38431
9.8
0%
May 5
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI)
Affected: through 15.103.1
CVE-2025-67289
9.6
0%
Dec 22
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file
Affected: 15.89.0
CVE-2026-31017
9.1
0%
Apr 8
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is…
Affected: 16.0.1
CVE-2026-27471
9.1
0%
Feb 21
ERP is a free and open source Enterprise Resource Planning tool
Affected: before 15.98.1; after 16.0.0 before 16.6.1; 16.0.0; 16.0.0; 16.0.0
CVE-2025-58439
9.1
0%
Sep 6
ERP is a free and open source Enterprise Resource Planning tool
Affected: before 14.89.2; 15.0.0 before 15.76.0
CVE-2025-65267
9.0
0%
Dec 3
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript
Affected: 15.83.2
CVE-2026-109667
8.8
0%
Oct 12
Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
Affected: before 15.111.0; 16.0.0-beta.1 before 16.22.0
CVE-2026-109652
8.8
0%
Oct 12
Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
Affected: before 15.119.1; 16.0.0-beta.1 before 16.32.0
CVE-2026-109608
8.8
0%
Oct 12
Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input
Affected: before 15.121.0; 16.0.0-beta.1 before 16.34.0
CVE-2026-55242
8.8
0%
Jul 15
ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix
Affected: < 15.111.0; >= 16.0.0, < 16.22.0
CVE-2023-54345
8.8
1%
May 5
Frappe Framework ERPNext 13.4.0 Remote Code Execution
Affected: 13.4.0
CVE-2025-66440
8.8
0%
Dec 15
An issue was discovered in Frappe ERPNext through 15.89.0
Affected: through 15.89.0
CVE-2025-66439
8.8
0%
Dec 15
An issue was discovered in Frappe ERPNext through 15.89.0
Affected: through 15.89.0
CVE-2025-66438
8.8
0%
Dec 15
A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism
Affected: through 15.89.0
CVE-2025-66437
8.8
1%
Dec 15
An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0
Affected: through 15.89.0
CVE-2025-66434
8.8
1%
Dec 15
An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0
Affected: through 15.89.0
CVE-2020-6145
8.8
2%
Aug 10
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38
Affected: 11.1.38
CVE-2018-3885
8.8
1%
Sep 12
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6
Affected: 10.1.6
CVE-2018-3884
8.8
1%
Sep 12
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6
Affected: 10.1.6
CVE-2018-3883
8.8
1%
Sep 12
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6
Affected: 10.1.6
CVE-2018-3882
8.8
1%
Sep 12
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6
Affected: 10.1.6
CVE-2025-52042
8.2
0%
Oct 1
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection,…
Affected: 15.57.5
CVE-2025-52041
8.2
0%
Oct 1
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows…
Affected: 15.57.5
CVE-2025-52040
8.2
0%
Oct 1
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information…
Affected: 15.57.5
CVE-2025-52039
8.2
0%
Oct 1
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection,…
Affected: 15.57.5
CVE-2026-109640
8.1
0%
Oct 12
Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
Affected: before 16.22.0
CVE-2026-109633
8.1
0%
Oct 12
Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
Affected: before 15.119.1; 16.0.0-beta.1 before 16.32.0
CVE-2025-71432
8.1
0%
Oct 12
Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover
Affected: before 14.92.1; 15.0.0 before 15.83.0
CVE-2025-28062
8.1
1%
May 5
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3
Affected: 14.74.3; 14.82.1
CVE-2026-108374
7.7
0%
Oct 16
ERPNext: Unauthorised status modification due to missing validation
Affected: < 15.121.0; >= 16.0.0, < 16.34.0
CVE-2026-65822
7.6
0%
Aug 17
ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter
Affected: < 15.116.0; >= 16.0.0, < 16.23.0
CVE-2026-44447
7.5
0%
May 13
ERPNext: Possibility of SQL Injection due to missing validation
Affected: < 16.9.0
CVE-2026-44446
7.5
0%
May 13
ERPNext: Possibility of SQL Injection due to missing validation
Affected: >= 16.0.0-beta.1, < 16.14.0; < 15.104.3
CVE-2026-32954
7.5
0%
Mar 20
ERP is a free and open source Enterprise Resource Planning tool
Affected: before 15.100.0; 16.0.0 before 16.8.0
CVE-2025-52044
7.5
0%
Sep 16
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from…
Affected: 15.57.5
CVE-2018-20061
7.5
1%
Dec 11
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29
Affected: 10.0.0 through 10.1.76; 11.0.0 before 11.0.3; 11.0.3; 11.0.3; 11.0.3; 11.0.3; +24 more
CVE-2026-109673
7.3
0%
Oct 12
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
Affected: before 15.103.0; 16.0.0-beta.1 before 16.12.0
CVE-2026-109671
7.3
0%
Oct 12
Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
Affected: before 15.113.0; 16.0.0-beta.1 before 16.24.0
CVE-2026-109653
7.3
0%
Oct 12
Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
Affected: before 15.119.0; 16.0.0-beta.1 before 16.31.0
CVE-2026-109612
7.3
0%
Oct 12
Frappe ERPNext before 15.120.0 Stored XSS via Report View
Affected: before 15.120.0; 16.0.0-beta.1 before 16.33.0
CVE-2026-109604
7.3
0%
Oct 12
ERPNext before 15.112.0 Stored XSS via Tool View Record Names
Affected: before 15.112.0; 16.0.0-beta.1 before 16.23.0
CVE-2026-109617
7.1
0%
Oct 12
Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints
Affected: before 15.121.0; 16.0.0-beta.1 before 16.34.0
CVE-2026-109616
7.1
0%
Oct 12
Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification
Affected: before 15.121.3; 16.0.0-beta.1 before 16.35.0
CVE-2026-109613
7.1
0%
Oct 12
Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification
Affected: before 15.121.0; 16.0.0-beta.1 before 16.34.0
CVE-2026-72910
7.1
0%
Aug 10
ERPNext: Unauthorised modification of master data due to missing validation
Affected: < 15.112.0; >= 16.0.0, < 16.22.0
CVE-2026-72909
7.1
0%
Aug 10
ERPNext: Broken Access Control on certain endpoints
Affected: < 15.112.0; >= 16.0.0, < 16.23.0
CVE-2026-13227
7.1
0%
Aug 4
ERPNext v16.25.0 - Improper authorization in Prospect opportunities API
Affected: before 15.115.0; before 16.26.0
Page 1 of 3 · 144 total
123