erpnext at a glance
- Last 12 months
- 98
- Critical · all time
- 4
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 4 | 0 |
| Oct 2026 | 70 | 0 |
| Sep 2026 | 2 | 0 |
| Aug 2026 | 9 | 2 |
| Jul 2026 | 2 | 0 |
| Jun 2026 | 2 | 0 |
| May 2026 | 7 | 1 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 1 | 0 |
| Feb 2026 | 1 | 1 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 1 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
99 results · Feed
-
Medium 4.3
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including por…
-
Medium 6.5
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary…
-
Medium 6.5
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_bom_items and get_bom_diff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, ca…
-
Medium 4.3
Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_linked_payments_for_doc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname val…
-
Medium 6.5
ERPNext: Unauthorised access to financial data due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user reque…
-
High 7.7
ERPNext: Unauthorised status modification due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whiteliste…
-
Medium 6.5
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate datab…
-
High 7.3
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can cra…
-
Medium 6.5
Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their…
-
High 7.3
Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes i…
-
Medium 5.4
Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name tha…
-
Medium 4.3
Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accoun…
-
Medium 4.3
Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints …
-
High 8.8
Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, incl…
-
Medium 6.5
Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify i…
-
Medium 4.3
Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records,…
-
Medium 4.3
Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role…
-
Medium 6.5
Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database q…
-
Medium 6.1
Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated at…
-
Medium 6.5
Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can quer…
-
Medium 6.5
Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify prod…
-
Medium 6.5
Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their as…
-
Medium 5.4
Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the br…
-
Medium 6.5
Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, b…
-
Medium 6.5
Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call the…
-
Medium 6.5
Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to …
-
Medium 5.4
Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call t…
-
High 7.3
Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record fiel…
-
Medium 4.3
Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authe…
-
High 8.8
Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenti…
-
Medium 6.5
Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read person…
-
Medium 6.5
Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the aff…
-
Medium 6.5
Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensi…
-
Medium 6.5
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database quer…
-
Medium 6.5
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and e…
-
Medium 6.5
Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify…
-
Medium 6.5
Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read…
-
Medium 4.3
Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned…
-
Medium 6.5
Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read pro…
-
Medium 6.5
Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate ava…