Vulnerabilities

TI-2026-32388 CVE-2026-44448

ERPNext: Unauthorised Document modification due to missing validation

LOW 28

ERPNext is a free and open source Enterprise Resource Planning tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00145 Published 2026-05-13 Fixed in 16.11.0, 15.102.0 CWE-862

TI-2026-32387 CVE-2026-44447

ERPNext: Possibility of SQL Injection due to missing validation

MEDIUM 40

ERPNext is a free and open source Enterprise Resource Planning tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00307 Published 2026-05-13 Fixed in 16.9.0 CWE-89

TI-2026-32386 CVE-2026-44446

ERPNext: Possibility of SQL Injection due to missing validation

MEDIUM 40

ERPNext is a free and open source Enterprise Resource Planning tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00266 Published 2026-05-13 Fixed in 16.14.0, 15.104.3 CWE-89

TI-2026-32385 CVE-2026-44445

ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module

LOW 23

ERPNext is a free and open source Enterprise Resource Planning tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00224 Published 2026-05-13 Fixed in 16.12.0, 15.104.3 CWE-611

TI-2026-32381 CVE-2026-44441

ERPNext: Possible SSRF by any authenticated user

LOW 22

ERPNext is a free and open source Enterprise Resource Planning tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00162 Published 2026-05-13 Fixed in 15.106.0, 16.16.0 CWE-918

TI-2026-32380 CVE-2026-44440

ERPNext: Path Traversal Leading to Sensitive File Exposure

LOW 29

ERPNext is a free and open source Enterprise Resource Planning tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00363 Published 2026-05-13 Fixed in 15.101.1, 16.10.0 CWE-22

TI-2026-32382 CVE-2026-44442

ERPNext: Unauthorised Document modification due to missing validation

MEDIUM 43

ERPNext is a free and open source Enterprise Resource Planning tool.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00279 Published 2026-05-13 Fixed in 16.9.1 CWE-862

TI-2023-30619 CVE-2023-54345 · GHSA-2347-whqp-m9vm

Frappe Framework ERPNext 13.4.0 Remote Code Execution

HIGH 73

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00609 Published 2026-05-05 No fix listed CWE-94

TI-2026-28141 CVE-2026-38432 · GHSA-78h5-gvjw-7pp9

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email…

MEDIUM 60

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00175 Published 2026-05-05 No fix listed CWE-79

TI-2026-28140 CVE-2026-38431 · GHSA-qwh3-h35h-9j9f

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI).

HIGH 82

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0039 Published 2026-05-05 No fix listed CWE-94

TI-2026-23822 CVE-2026-31017 · GHSA-2vgp-8568-m98f

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format…

MEDIUM 47

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00245 Published 2026-04-08 No fix listed CWE-918

TI-2026-25402 CVE-2026-32954

ERP has a possibility SQL Injection vulnerability due to missing validation

LOW 33

ERP is a free and open source Enterprise Resource Planning tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00327 Published 2026-03-20 Fixed in 16.8.0, 15.100.0 CWE-89

TI-2026-21878 CVE-2026-27471

ERP: Document access through endpoints due to missing validation

MEDIUM 48

ERP is a free and open source Enterprise Resource Planning tool.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00368 Published 2026-02-21 Fixed in 16.6.1, 15.98.1 CWE-284

TI-2025-40511 CVE-2025-65924 · GHSA-2wwr-rx4c-q4hx

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>`…

LOW 19

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text.

CVSS 3.1MEDIUM 4.1 Network Low privileges User interaction EPSS 0.00258 Published 2026-02-03 No fix listed CWE-80

TI-2025-40510 CVE-2025-65923 · GHSA-f24j-7vph-7pq3

A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import…

LOW 24

A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00197 Published 2026-02-03 No fix listed CWE-79

TI-2025-41184 CVE-2025-67289 · GHSA-9924-rxm2-pj79

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework…

MEDIUM 43

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00463 Published 2025-12-22 No fix listed CWE-434

TI-2025-40873 CVE-2025-66440 · GHSA-rx6f-68r9-j7w6

An issue was discovered in Frappe ERPNext through 15.89.0.

HIGH 82

An issue was discovered in Frappe ERPNext through 15.89.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00379 Published 2025-12-15 No fix listed CWE-89

TI-2025-40872 CVE-2025-66439 · GHSA-6329-q89j-9c7m

An issue was discovered in Frappe ERPNext through 15.89.0.

HIGH 82

An issue was discovered in Frappe ERPNext through 15.89.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00379 Published 2025-12-15 No fix listed CWE-89

TI-2025-40871 CVE-2025-66438 · GHSA-5x94-7mhw-9ff6

A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext…

HIGH 82

A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.005 Published 2025-12-15 No fix listed CWE-1336

TI-2025-40870 CVE-2025-66437 · GHSA-36qq-9v26-crfg

An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display…

HIGH 73

An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.006 Published 2025-12-15 No fix listed CWE-1336

TI-2025-40869 CVE-2025-66436 · GHSA-mc79-8xp6-rcw8

An SSTI (Server-Side Template Injection) vulnerability exists in the…

MEDIUM 53

An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00336 Published 2025-12-15 No fix listed CWE-1336

TI-2025-40868 CVE-2025-66435 · GHSA-hc98-xxm8-jfgj

An SSTI (Server-Side Template Injection) vulnerability exists in the…

MEDIUM 53

An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00336 Published 2025-12-15 No fix listed CWE-1336

TI-2025-40867 CVE-2025-66434 · GHSA-gmxm-2p67-967r

An SSTI (Server-Side Template Injection) vulnerability exists in the…

HIGH 73

An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0059 Published 2025-12-15 No fix listed CWE-1336

TI-2025-40308 CVE-2025-65267 · GHSA-33qr-xp8v-vv64

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG…

MEDIUM 41

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00372 Published 2025-12-03 No fix listed CWE-79

TI-2025-35319 CVE-2025-56381 · GHSA-899m-3xff-2xg9

ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the…

HIGH 70

ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00314 Published 2025-10-02 No fix listed CWE-89

Vulnerabilities

Filters