Threat database

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.

CVE-2026-109662 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext affecting versions before 15.112.0 and 16.x before 16.23.0. The flaw exists in a public portal form that allows unauthenticated submissions, which are stored and later rendered without proper neutralization. This enables unauthenticated attackers to inject malicious markup that executes in the browsers of staff reviewing the stored content. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3.

CVE-2026-109661 is a missing authorization vulnerability in Frappe ERPNext versions before 15.116.0 and 16.x before 16.27.0. This flaw allows authenticated users with low privileges to access financial data beyond their authorized roles by querying certain endpoints that lack proper authorization checks.

CVE-2026-109660 is a vulnerability in Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 where certain endpoints lack proper authorization checks. This allows authenticated users with low privileges to modify production records beyond their permitted roles.

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.

Frappe ERPNext versions 16.0.0-beta.1 up to but not including 16.27.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with edit permissions to inject malicious scripts via record names that are rendered without proper escaping. When other users view the affected pages, the injected script executes in their browsers. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.

CVE-2026-109656 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.118.2 and 16.x before 16.30.0. It allows authenticated users with low privileges to access item master data beyond their authorized roles by exploiting certain endpoints that do not enforce proper authorization checks.

CVE-2026-109655 is a missing authorization vulnerability in Frappe ERPNext versions before 15.115.0 and 16.x before 16.26.0. Certain endpoints do not enforce proper role-based authorization checks, allowing authenticated low-privileged users to modify inventory records beyond their permitted roles.

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read.

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.

CVE-2026-109652 is a server-side template injection vulnerability in Frappe ERPNext. It affects versions before 15.119.1 and 16.x before 16.32.0. The flaw arises because user-controlled message fields are not properly validated before template rendering, allowing authenticated users with common operational roles to inject template expressions. This can lead to unauthorized reading and writing of database data, document deletion, outbound server requests, and sending mail from the site.

CVE-2026-109651 is a server-side request forgery (SSRF) vulnerability in Frappe ERPNext. It affects versions before 15.112.0 and 16.x before 16.23.0. The flaw arises from a configuration field writable by common operational roles that allows arbitrary outbound request destinations without validation. This enables authenticated attackers to make the server send requests to internal network addresses that are otherwise inaccessible externally.

CVE-2026-109650 is a missing authorization vulnerability in Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0. This flaw allows authenticated low-privileged users to access personal data beyond their role permissions by exploiting certain endpoints that lack proper authorization checks.

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.

CVE-2026-109647 is an SQL injection vulnerability in Frappe ERPNext affecting versions before 15.106.0 and 16.x before 16.16.0. The flaw arises from missing input validation in multiple endpoints, allowing authenticated attackers to manipulate database queries and extract sensitive data. The vulnerability has a high severity score of 7.1 and requires authenticated access to exploit.

CVE-2026-109646 is an SQL injection vulnerability in Frappe ERPNext affecting versions before 15.106.0 and 16.x before 16.16.0. It allows authenticated low-privileged attackers to inject SQL commands via certain endpoints lacking proper input validation, potentially exposing sensitive database information.

CVE-2026-109645 is a missing authorization vulnerability in Frappe ERPNext that affects versions before 15.119.0 and 16.x before 16.31.0. This flaw allows authenticated users to bypass role-based access controls on certain endpoints, enabling them to create and modify records beyond their permissions. The vulnerability has a high severity with a CVSS score of 7.1.

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.