Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: frappe erpnext 15.119.0, 16.31.0 Clear all filters
TI-2026-71413 CVE-2026-109654 · GHSA-392r-p4m6-pq6x

Frappe ERPNext Missing Authorization in Transactional Email Endpoints

Priority LOW 23

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00174 Published 2026-10-12 Fixed in 15.119.0, 16.31.0 CWE-862
TI-2026-71412 CVE-2026-109653 · GHSA-g9jx-m3gp-q3jv

Stored cross-site scripting in Frappe ERPNext enables account takeover

Priority LOW 36

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00207 Published 2026-10-12 Fixed in 15.119.0, 16.31.0 CWE-79
TI-2026-71404 CVE-2026-109645 · GHSA-2fwf-v7xj-x7wp

Missing authorization in Frappe ERPNext lets users create and modify records

Priority LOW 31

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00247 Published 2026-10-12 Fixed in 15.119.0, 16.31.0 CWE-862
TI-2026-71403 CVE-2026-109644 · GHSA-5qgv-7fq4-46p6

Missing authorization in Frappe ERPNext exposes valuation data

Priority LOW 31

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-10-12 Fixed in 15.119.0, 16.31.0 CWE-862