Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: frappe erpnext 15.106.0, 16.16.0 Clear all filters
TI-2026-71407 CVE-2026-109648 · GHSA-vfcx-pfmr-f4vw

SQL injection in Frappe ERPNext via missing input validation

Priority LOW 31

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00276 Published 2026-10-12 Fixed in 15.106.0, 16.16.0 CWE-89
TI-2026-71406 CVE-2026-109647 · GHSA-76ff-wm2c-rg2q

SQL injection in Frappe ERPNext via missing input validation

Priority LOW 31

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00276 Published 2026-10-12 Fixed in 15.106.0, 16.16.0 CWE-89
TI-2026-71405 CVE-2026-109646 · GHSA-wmgh-92f9-wwjr

SQL injection in Frappe ERPNext via missing input validation

Priority LOW 31

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00276 Published 2026-10-12 Fixed in 15.106.0, 16.16.0 CWE-89