erpnext
- Software type
- Enterprise resource planning
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, erpnext recorded 78 security vulnerabilities in the last 90 days, of which 54 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of erpnext and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-109630Frappe ERPNext before 15.121.0 Missing Authorization in EndpointsCVE-2026-109629Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email EndpointCVE-2026-109628Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing AuthorizationCVE-2026-109627Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial DataCVE-2026-109626Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-109630Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-109629Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109628Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109627Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109626Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109625Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109624Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109623Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109622Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109621Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109617Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109616Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109615Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109614Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109613Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109612Frappe ERPNext before 15.120.0 Stored XSS via Report View | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109611Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109610Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109609Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109608Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109604ERPNext before 15.112.0 Stored XSS via Tool View Record Names | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109377ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods | Exploitation statusNot confirmed | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109376ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html | Exploitation statusNot confirmed | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2025-71432Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-96672Frappe ERPNext before 16.34.1 Unauthorized Method Invocation | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityMedium |
|---|
CVE-2026-94113Frappe ERPNext Timesheet Endpoints Allow Unauthorized Data Disclosure | Exploitation statusNot confirmed | FixYes | Published09/20/2026 | SeverityHigh |
|---|
CVE-2026-65974Server-side template injection enables remote code execution in Frappe ERPNext | Exploitation statusNot exploited | FixYes | Published08/17/2026 | SeverityCritical |
|---|
CVE-2026-65822ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter | Exploitation statusNot exploited | FixYes | Published08/17/2026 | SeverityHigh |
|---|
CVE-2026-72911Frappe ERPNext server-side template injection enables arbitrary code execution | Exploitation statusNot exploited | FixYes | Published08/10/2026 | SeverityCritical |
|---|
CVE-2026-72910ERPNext: Unauthorised modification of master data due to missing validation | Exploitation statusNot exploited | FixYes | Published08/10/2026 | SeverityHigh |
|---|
CVE-2026-72909ERPNext: Broken Access Control on certain endpoints | Exploitation statusNot exploited | FixYes | Published08/10/2026 | SeverityHigh |
|---|
CVE-2026-72908ERPNext: Possibility of SQL injection due to missing validation | Exploitation statusNot exploited | FixYes | Published08/10/2026 | SeverityMedium |
|---|
CVE-2026-72907ERPNext: Broken Access Control on certain endpoint | Exploitation statusNot exploited | FixYes | Published08/10/2026 | SeverityMedium |
|---|
CVE-2026-72906ERPNext: Unauthorised triggering of automated emails due to missing validation | Exploitation statusNot exploited | FixYes | Published08/10/2026 | SeverityMedium |
|---|
CVE-2026-13227ERPNext v16.25.0 - Improper authorization in Prospect opportunities API | Exploitation statusActively exploited | FixYes | Published08/04/2026 | SeverityHigh |
|---|
CVE-2026-12895SQL Injection in Frappe's ERPNext | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-55242ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix | Exploitation statusNot exploited | FixYes | Published07/15/2026 | SeverityHigh |
|---|
CVE-2026-42840ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals | Exploitation statusActively exploited | FixNo | Published06/03/2026 | SeverityMedium |
|---|
CVE-2026-42839ERPNext 16.16.0 - Stored XSS in POS cart item rendering | Exploitation statusNot exploited | FixNo | Published06/03/2026 | SeverityMedium |
|---|
CVE-2026-44448ERPNext: Unauthorised Document modification due to missing validation | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-44447ERPNext: Possibility of SQL Injection due to missing validation | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-44446ERPNext: Possibility of SQL Injection due to missing validation | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-44445ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-44442ERPNext: Unauthorised Document modification due to missing validation | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityCritical |
|---|
CVE-2026-44441ERPNext: Possible SSRF by any authenticated user | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-44440ERPNext: Path Traversal Leading to Sensitive File Exposure | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-32954ERP has a possibility SQL Injection vulnerability due to missing validation | Exploitation statusNot exploited | FixYes | Published03/20/2026 | SeverityHigh |
|---|
CVE-2026-27471ERP: Document access through endpoints due to missing validation | Exploitation statusNot exploited | FixYes | Published02/21/2026 | SeverityCritical |
|---|
CVE-2025-58439ERP: Possibility of SQL injection due to missing validation | Exploitation statusNot exploited | FixYes | Published09/06/2025 | SeverityHigh |
|---|
99 Results | Page 2 of 2