Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: frappe erpnext 15.119.1, 16.32.0 Clear all filters
TI-2026-71411 CVE-2026-109652 · GHSA-cw68-6fr5-c994

Server-side template injection in Frappe ERPNext message fields

Priority LOW 39

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to r…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00305 Published 2026-10-12 Fixed in 15.119.1, 16.32.0 CWE-1336
TI-2026-71392 CVE-2026-109633 · GHSA-rcfr-6r59-hm5x

Stored cross-site scripting in Frappe ERPNext via public booking page

Priority MEDIUM 43

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00245 Published 2026-10-12 Fixed in 15.119.1, 16.32.0 CWE-79
TI-2026-71390 CVE-2026-109631 · GHSA-64j4-p9wv-83pg

SQL injection in Frappe ERPNext via missing input validation

Priority LOW 31

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00276 Published 2026-10-12 Fixed in 15.119.1, 16.32.0 CWE-89
TI-2026-71372 CVE-2026-109610 · GHSA-mr9w-mfcg-7xq4

Missing authorization in Frappe ERPNext lets users modify documents

Priority LOW 31

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-12 Fixed in 15.119.1, 16.32.0 CWE-862
TI-2026-71371 CVE-2026-109609 · GHSA-fgjj-x552-v3pw

SQL injection in Frappe ERPNext via missing input validation

Priority LOW 31

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00276 Published 2026-10-12 Fixed in 15.119.1, 16.32.0 CWE-89