Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: frappe erpnext 15.112.0, 16.23.0 Clear all filters
TI-2026-71421 CVE-2026-109662 · GHSA-hv86-v32f-rvgp

Frappe ERPNext Stored XSS via Public Portal Form

Priority LOW 23

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insuffic…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00205 Published 2026-10-12 Fixed in 15.112.0, 16.23.0 CWE-79
TI-2026-71419 CVE-2026-109660 · GHSA-vfg5-9jm2-q8rr

Missing authorization in Frappe ERPNext production record endpoints

Priority LOW 31

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-12 Fixed in 15.112.0, 16.23.0 CWE-862
TI-2026-71410 CVE-2026-109651 · GHSA-r69h-vwpx-6874

Server-side request forgery in Frappe ERPNext via configuration field

Priority LOW 23

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound reques…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-10-12 Fixed in 15.112.0, 16.23.0 CWE-918
TI-2026-71409 CVE-2026-109650 · GHSA-24gr-27x8-vv32

Missing authorization in Frappe ERPNext exposes personal data

Priority LOW 31

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-10-12 Fixed in 15.112.0, 16.23.0 CWE-862
TI-2026-71369 CVE-2026-109604 · GHSA-frw3-f8vj-wxg9

Stored XSS in Frappe ERPNext via tool view record names

Priority LOW 38

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00207 Published 2026-10-12 Fixed in 15.112.0, 16.23.0 CWE-79