What’s Vulnerable › Products

frappe erpnext vulnerabilities

144 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 122 published in the last 12 months.

Check whether your frappe erpnext version is affected

Latest frappe erpnext vulnerabilities

• CVE-2026-108374 — ERPNext: Unauthorised status modification due to missing validation (CVSS 7.7)
• CVE-2026-108373 — ERPNext: Unauthorised access to financial data due to missing validation (CVSS 6.5)
• CVE-2026-109674 — Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation (CVSS 6.5)
• CVE-2026-109673 — Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names (CVSS 7.3)
• CVE-2026-109672 — Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data (CVSS 6.5)
• CVE-2026-109671 — Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages (CVSS 7.3)
• CVE-2026-109670 — Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name (CVSS 5.4)
• CVE-2026-109669 — Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification (CVSS 4.3)
• CVE-2026-109668 — Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints (CVSS 4.3)
• CVE-2026-109667 — Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation (CVSS 8.8)
• CVE-2026-109666 — Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints (CVSS 6.5)
• CVE-2026-109665 — Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation (CVSS 4.3)
• CVE-2026-109664 — Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification (CVSS 4.3)
• CVE-2026-109663 — Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters (CVSS 6.5)
• CVE-2026-109662 — Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form (CVSS 6.1)
• CVE-2026-109661 — Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data (CVSS 6.5)
• CVE-2026-109660 — Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints (CVSS 6.5)
• CVE-2026-109659 — Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data (CVSS 6.5)
• CVE-2026-109658 — Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints (CVSS 6.5)
• CVE-2026-109657 — Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name (CVSS 5.4)
• CVE-2026-109656 — Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access (CVSS 6.5)
• CVE-2026-109655 — Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints (CVSS 6.5)
• CVE-2026-109654 — Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints (CVSS 5.4)
• CVE-2026-109653 — Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover (CVSS 7.3)
• CVE-2026-109652 — Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields (CVSS 8.8)