Erpnext
by Frappe
Source repositories
CVEs (70)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-20061 | Hig | 0.49 | 7.5 | 0.01 | Dec 11, 2018 | A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a… | ||
| CVE-2026-13227 | Hig | 0.46 | — | 0.00 | Aug 4, 2026 | An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0. | ||
| CVE-2022-28598 | Med | 0.43 | 6.1 | 0.03 | Aug 22, 2022 | Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. | ||
| CVE-2018-11339 | Med | 0.43 | 6.1 | 0.04 | May 22, 2018 | An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. | ||
| CVE-2025-56381 | Med | 0.42 | 6.5 | 0.00 | Oct 2, 2025 | ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters. | ||
| CVE-2025-56380 | Med | 0.42 | 6.5 | 0.00 | Oct 2, 2025 | Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter | ||
| CVE-2026-38432 | Med | 0.40 | 6.1 | 0.00 | May 5, 2026 | ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied. | ||
| CVE-2019-20521 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI. | ||
| CVE-2019-20520 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI. | ||
| CVE-2019-20519 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address. | ||
| CVE-2019-20518 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI. | ||
| CVE-2019-20517 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. | ||
| CVE-2019-20516 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. | ||
| CVE-2019-20515 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. | ||
| CVE-2019-20514 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2020 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. | ||
| CVE-2019-20511 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2020 | ERPNext 11.1.47 allows blog?blog_category= Frame Injection. | ||
| CVE-2026-72910 | Hig | 0.39 | 7.1 | 0.00 | Aug 10, 2026 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py,… | ||
| CVE-2026-72909 | Hig | 0.39 | — | 0.00 | Aug 10, 2026 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to… | ||
| CVE-2026-32954 | Hig | 0.39 | 7.1 | 0.00 | Mar 20, 2026 | ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database… | ||
| CVE-2026-72908 | Med | 0.35 | 6.5 | 0.00 | Aug 10, 2026 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an… |
- risk 0.49cvss 7.5epss 0.01
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a…
- risk 0.46cvss —epss 0.00
An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0.
- risk 0.43cvss 6.1epss 0.03
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.
- risk 0.43cvss 6.1epss 0.04
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.
- risk 0.42cvss 6.5epss 0.00
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.
- risk 0.42cvss 6.5epss 0.00
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter
- risk 0.40cvss 6.1epss 0.00
ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
- risk 0.40cvss 6.1epss 0.01
ERPNext 11.1.47 allows blog?blog_category= Frame Injection.
- risk 0.39cvss 7.1epss 0.00
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py,…
- risk 0.39cvss —epss 0.00
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to…
- risk 0.39cvss 7.1epss 0.00
ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database…
- risk 0.35cvss 6.5epss 0.00
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an…
Page 2 of 4