frappe

Top products

The 15 most recently published vulnerabilities affecting frappe.

• CVE-2026-72911ERPNext: Possibility of server-side template injection due to missing validation9.9Aug 10, 2026
• CVE-2026-72910ERPNext: Unauthorised modification of master data due to missing validation7.1Aug 10, 2026
• CVE-2026-72908ERPNext: Possibility of SQL injection due to missing validation6.5Aug 10, 2026
• CVE-2026-72907ERPNext: Broken Access Control on certain endpoint6.5Aug 10, 2026
• CVE-2026-72906ERPNext: Unauthorised triggering of automated emails due to missing validation4.3Aug 10, 2026
• CVE-2025-58375Frappe has potential SQL Injection due to missing validation8.1Aug 7, 2026
• CVE-2026-55242ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix8.8Jul 15, 2026
• CVE-2026-46546Frappe LMS: HTML injection in user-controlled metadata5.4Jun 9, 2026
• CVE-2026-45081Frappe HR: Permission Bypass in HRMS Leave Details API6.5May 27, 2026
• CVE-2026-44448ERPNext: Unauthorised Document modification due to missing validation5.9May 13, 2026
• CVE-2026-44447ERPNext: Possibility of SQL Injection due to missing validation8.8May 13, 2026
• CVE-2026-44446ERPNext: Possibility of SQL Injection due to missing validation8.8May 13, 2026
• CVE-2026-44445ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module6.5May 13, 2026
• CVE-2026-44441ERPNext: Possible SSRF by any authenticated user5.0May 13, 2026
• CVE-2026-44440ERPNext: Path Traversal Leading to Sensitive File Exposure6.5May 13, 2026