Login Request a demo
ER
Product
erpnext
by frappe · last CVE Oct 16, 2026
144
CVEs
0
On KEV
9.9
Max CVSS
70
New 30D
Vulnerabilities144In the news0Timeline
Severity mix
Critical 9High 42Medium 90Low 0
Severity
All severities144Critical9High42Medium90Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add erpnext to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-12895
7.1
0%
Jul 29
SQL Injection in Frappe's ERPNext
Affected: before 15.111.0; before 16.22.0
CVE-2026-108373
6.5
0%
Oct 16
ERPNext: Unauthorised access to financial data due to missing validation
Affected: < 15.118.0; >= 16.0.0, < 16.27.0
CVE-2026-109674
6.5
0%
Oct 12
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
Affected: before 15.98.0; 16.0.0-beta.1 before 16.6.0
CVE-2026-109672
6.5
0%
Oct 12
Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
Affected: before 15.118.0; 16.0.0-beta.1 before 16.27.0
CVE-2026-109666
6.5
0%
Oct 12
Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
Affected: before 15.110.0; 16.0.0-beta.1 before 16.21.0
CVE-2026-109663
6.5
0%
Oct 12
Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
Affected: before 15.113.0; 16.0.0-beta.1 before 16.22.0
CVE-2026-109661
6.5
0%
Oct 12
Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
Affected: before 15.116.0; 16.0.0-beta.1 before 16.27.0
CVE-2026-109660
6.5
0%
Oct 12
Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
Affected: before 15.112.0; 16.0.0-beta.1 before 16.23.0
CVE-2026-109659
6.5
0%
Oct 12
Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
Affected: before 15.113.0; 16.0.0-beta.1 before 16.24.0
CVE-2026-109658
6.5
0%
Oct 12
Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
Affected: before 15.115.0; 16.0.0-beta.1 before 16.26.0
CVE-2026-109656
6.5
0%
Oct 12
Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
Affected: before 15.118.2; 16.0.0-beta.1 before 16.30.0
CVE-2026-109655
6.5
0%
Oct 12
Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
Affected: before 15.115.0; 16.0.0-beta.1 before 16.26.0
CVE-2026-109650
6.5
0%
Oct 12
Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
Affected: before 15.112.0; 16.0.0-beta.1 before 16.23.0
CVE-2026-109649
6.5
0%
Oct 12
Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
Affected: before 15.102.0; 16.0.0-beta.1 before 16.11.0
CVE-2026-109648
6.5
0%
Oct 12
Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
Affected: before 15.106.0; 16.0.0-beta.1 before 16.16.0
CVE-2026-109647
6.5
0%
Oct 12
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
Affected: before 15.106.0; 16.0.0-beta.1 before 16.16.0
CVE-2026-109646
6.5
0%
Oct 12
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
Affected: before 15.106.0; 16.0.0-beta.1 before 16.16.0
CVE-2026-109645
6.5
0%
Oct 12
Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
Affected: before 15.119.0; 16.0.0-beta.1 before 16.31.0
CVE-2026-109644
6.5
0%
Oct 12
Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
Affected: before 15.119.0; 16.0.0-beta.1 before 16.31.0
CVE-2026-109643
6.5
0%
Oct 12
Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
Affected: before 15.111.0; 16.0.0-beta.1 before 16.22.0
CVE-2026-109641
6.5
0%
Oct 12
Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
Affected: before 15.110.0; 16.0.0-beta.1 before 16.21.0
CVE-2026-109639
6.5
0%
Oct 12
Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
Affected: before 15.102.0; 16.0.0-beta.1 before 16.8.0
CVE-2026-109638
6.5
0%
Oct 12
Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
Affected: before 15.110.0; 16.0.0-beta.1 before 16.21.0
CVE-2026-109637
6.5
0%
Oct 12
Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
Affected: before 16.14.0
CVE-2026-109636
6.5
0%
Oct 12
Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
Affected: before 15.115.0; 16.0.0-beta.1 before 16.26.0
CVE-2026-109632
6.5
0%
Oct 12
Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints
Affected: before 15.121.0; 16.0.0-beta.1 before 16.33.0
CVE-2026-109631
6.5
0%
Oct 12
Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation
Affected: before 15.119.1; 16.0.0-beta.1 before 16.32.0
CVE-2026-109628
6.5
0%
Oct 12
Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization
Affected: before 15.121.0; 16.0.0-beta.1 before 16.34.0
CVE-2026-109627
6.5
0%
Oct 12
Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data
Affected: before 15.120.0; 16.0.0-beta.1 before 16.33.0
CVE-2026-109626
6.5
0%
Oct 12
Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints
Affected: before 16.34.2
CVE-2026-109625
6.5
0%
Oct 12
Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data
Affected: before 15.121.3; 16.0.0-beta.1 before 16.35.0
CVE-2026-109624
6.5
0%
Oct 12
Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data
Affected: before 15.120.0; 16.0.0-beta.1 before 16.33.0
CVE-2026-109621
6.5
0%
Oct 12
Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
Affected: before 15.120.0; 16.0.0-beta.1 before 16.23.0
CVE-2026-109615
6.5
0%
Oct 12
Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
Affected: before 15.121.0; 16.0.0-beta.1 before 16.34.0
CVE-2026-109614
6.5
0%
Oct 12
Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
Affected: before 16.34.0
CVE-2026-109610
6.5
0%
Oct 12
Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification
Affected: before 15.119.1; 16.0.0-beta.1 before 16.32.0
CVE-2026-109609
6.5
0%
Oct 12
Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation
Affected: before 15.119.1; 16.0.0-beta.1 before 16.32.0
CVE-2026-94113
6.5
0%
Sep 20
Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints
Affected: before 15.121.0; 16.0.0 before 16.34.0
CVE-2026-72908
6.5
1%
Aug 10
ERPNext: Possibility of SQL injection due to missing validation
Affected: < 15.109.0; >= 16.0.0, < 16.20.0
CVE-2026-72907
6.5
0%
Aug 10
ERPNext: Broken Access Control on certain endpoint
Affected: < 15.111.0; >= 16.0.0, < 16.22.0
CVE-2026-44448
6.5
0%
May 13
ERPNext: Unauthorised Document modification due to missing validation
Affected: >= 16.0.0-beta.1, < 16.11.0; < 15.102.0
CVE-2026-44445
6.5
0%
May 13
ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module
Affected: >= 16.0.0-beta.1, < 16.12.0; < 15.104.3
CVE-2025-56381
6.5
0%
Oct 2
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters
Affected: 15.67.0
CVE-2025-56380
6.5
0%
Oct 2
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to…
Affected: 15.67.0
CVE-2025-52050
6.5
0%
Sep 30
In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection,…
Affected: 15.57.5
CVE-2025-52049
6.5
0%
Sep 30
In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to…
Affected: 15.57.5
CVE-2025-52047
6.5
0%
Sep 30
In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information…
Affected: 15.57.5
CVE-2025-52043
6.5
0%
Sep 30
In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL injection, which…
Affected: 15.57.5
CVE-2026-96672
6.4
0%
Sep 23
Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
Affected: 16.0.0 before 16.34.1
CVE-2026-109662
6.1
0%
Oct 12
Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
Affected: before 15.112.0; 16.0.0-beta.1 before 16.23.0
Page 2 of 3 · 144 total
123