Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: frappe erpnext 15.110.0, 16.21.0 Clear all filters
TI-2026-71429 CVE-2026-109670 · GHSA-q4x9-8g7q-4mg9

Stored cross-site scripting in Frappe ERPNext via item record names

Priority LOW 22

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00168 Published 2026-10-12 Fixed in 15.110.0, 16.21.0 CWE-79
TI-2026-71428 CVE-2026-109669 · GHSA-w4pv-6pxp-chfv

Missing authorization in Frappe ERPNext allows unauthorized status changes

Priority LOW 23

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-10-12 Fixed in 15.110.0, 16.21.0 CWE-862
TI-2026-71427 CVE-2026-109668 · GHSA-9m7p-fw22-r42w

Missing authorization in Frappe ERPNext party record endpoints

Priority LOW 23

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted rol…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00192 Published 2026-10-12 Fixed in 15.110.0, 16.21.0 CWE-862
TI-2026-71425 CVE-2026-109666 · GHSA-pvq6-r4wx-77pr

Frappe ERPNext inventory endpoints lack authorization, allowing data changes

Priority LOW 31

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-12 Fixed in 15.110.0, 16.21.0 CWE-862
TI-2026-71401 CVE-2026-109642 · GHSA-m7wc-r33f-427q

Missing authorization in Frappe ERPNext endpoints exposes data

Priority LOW 29

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-10-12 Fixed in 15.110.0, 16.21.0 CWE-862
TI-2026-71400 CVE-2026-109641 · GHSA-9h3g-qxq9-cw8j

Missing authorization in Frappe ERPNext record creation endpoints

Priority LOW 36

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00316 Published 2026-10-12 Fixed in 15.110.0, 16.21.0 CWE-862
TI-2026-71397 CVE-2026-109638 · GHSA-fr36-h63g-fcp4

SQL injection in Frappe ERPNext via missing input validation

Priority LOW 31

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00276 Published 2026-10-12 Fixed in 15.110.0, 16.21.0 CWE-89