Erpnext
Monthly
Missing authorization checks in ERPNext versions prior to 15.121.0 and 16.34.0 let any authenticated user with a low-privilege role invoke state-changing whitelisted endpoints - such as Ledger Merge, Process Period Closing Voucher start/pause/cancel, Repost Payment Ledger, Delivery Note sales return, payment order, and bulk transaction processing - without the write, submit, cancel, or role permissions those operations should require, allowing tampering with financial and transactional records beyond the user's assigned role. The flaw is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so exploitation requires a valid low-privileged account but no admin rights, no user interaction, and no non-default configuration; integrity impact is high while confidentiality is unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the attack surface is standard functionality present in every affected deployment, so multi-user or internet-exposed instances should treat this as high priority. Vendor-released patch: 15.121.0 and 16.34.0.
SQL injection in Frappe ERPNext releases before 15.98.0 and 16.x before 16.6.0 lets remote attackers who already hold a valid application session inject crafted input into a subset of endpoints and manipulate backend database queries, reading sensitive records the account would not otherwise be able to access. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the primary limiting factor is authentication: a low-privilege ERPNext account is required, but no user interaction and no non-default configuration are needed, so default deployments on the affected versions are exposed to any logged-in user. Impact is confined to confidentiality - no integrity or availability effect - which keeps this a credible but moderate-priority issue rather than an emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing). Exposure is highest for internet-facing ERPNext instances that offer self-service registration or lightly provisioned accounts.
Stored cross-site scripting in Frappe ERPNext allows an authenticated user with permission to create or rename records to plant script payloads in record names that are later rendered without proper neutralization on certain dashboards, tools, and portal pages. Versions before 15.103.0 and 16.x before 16.12.0 are affected; the vulnerability scores CVSS 4.0 8.5 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N) and the independent assessment rates it a credible, above-average-priority issue rather than an emergency, because a valid low-privilege login is mandatory, the payload only fires when a victim - ideally a privileged user - opens the specific affected view, and the attacker cannot control exact timing. Successful exploitation can read or modify data and steal session tokens from other users' browsers; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Installations running 15.103.0+ or 16.12.0+ are not vulnerable.
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 allows authenticated low-privilege users to read financial data beyond their assigned role because certain endpoints do not enforce proper authorization checks (CWE-862). The vulnerability is remote and requires valid ERPNext credentials (PR:L) with no user interaction, but impact is limited to high confidentiality read exposure with no write or availability effect; no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than a top-tier emergency, with practical risk highest in broad-user-base or multi-tenant deployments where many low-privilege or portal accounts can reach the affected endpoints.
Stored cross-site scripting in Frappe ERPNext (before 15.113.0 and 16.x before 16.24.0) allows an authenticated low-privilege user to persist malicious script in a profile field that is rendered without escaping into portal pages; the payload executes in the browser of any administrator viewing those pages, enabling administrator account takeover. Exploitation requires a low-privilege account with access to edit the vulnerable profile field - realistic where ERPNext exposes self-service portal/website accounts for customers or suppliers - plus administrator interaction to load the poisoned page, which bounds risk below that of a pre-authentication, zero-interaction XSS. No public exploit code was identified at time of analysis.
Privilege escalation in Frappe ERPNext lets any authenticated user - including one holding no operational role - create privileged records such as user accounts and role assignments, ultimately taking full control of the site. The flaw affects releases before 15.111.0 and 16.x before 16.22.0, and stems from a record-creation endpoint that derives the record type from the request and inserts it with permission checks disabled; the only prerequisite is a valid login (CVSS 4.0 vector PR:L, i.e. authenticated, no user interaction, no non-default configuration). Rated 8.7 with high confidentiality, integrity and availability impact across the vulnerable site, and no public exploit code has been identified at time of analysis.
Frappe ERPNext fails to enforce permission checks on certain inventory-record endpoints, letting any authenticated user - regardless of assigned role - modify stock and inventory data they should not be able to touch. The flaw affects releases before 15.110.0 and 16.x before 16.21.0, requires a valid ERPNext session (CVSS PR:L, not anonymous), and impacts data integrity only: there is no disclosure of records and no denial of service. It is a moderate-priority authorization defect rather than a critical emergency, and no public exploit code has been identified at time of analysis; vendor fixes are available in 15.110.0 and 16.21.0. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
SQL injection in Frappe ERPNext (15.x before 15.113.0 and 16.x before 16.22.0) allows attackers with a valid ERPNext account to inject crafted parameters into database queries and read sensitive records from the underlying database. Exploitation requires an authenticated session over the network and no user interaction; the flaw yields high confidentiality impact with no integrity or availability impact. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the primary risk driver is the availability of low-privilege accounts - risk rises sharply where self-service or open registration is enabled or where the instance is internet-exposed.
Frappe ERPNext instances running versions before 15.116.0, or 16.x before 16.27.0, expose financial data to any user who can authenticate, because specific endpoints omit the role-based authorization checks that should gate them. An attacker holding a valid but low-privileged account can query those endpoints directly and read financial records that their role does not permit, resulting in high confidentiality impact with no integrity or availability effect. Exploitation requires authentication (CVSS PR:L) and no user interaction, so the realistic threat is a malicious or compromised insider, portal user, or leaked low-privilege credential rather than an anonymous internet drive-by; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Missing authorization checks in Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 let an authenticated, low-privileged user reach specific endpoints that modify production records and change data beyond the scope of their assigned role. Because the flaw is an integrity-only problem (CVSS:4.0 7.1; VI:H, VC:N, VA:N), attackers cannot read protected data or disrupt availability - they can only tamper with production/manufacturing records they should not be able to touch. Exploitation requires a valid low-privileged account and knowledge of the affected endpoint paths (PR:L per the assessed CVSS:3.1 vector); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but moderate-priority issue rather than a critical emergency.
Missing authorization checks in Frappe ERPNext 15.x before 15.113.0 and 16.x before 16.24.0 allow any authenticated user to call affected endpoints that omit role validation and read financial records their assigned permissions do not cover. Exploitation requires a valid ERPNext session (CVSS PR:L), so the practical threat is a low-privilege insider, malicious employee, or compromised portal account rather than an anonymous internet attacker, and the outcome is limited to data disclosure with no modification or service disruption. No public exploit code has been identified at time of analysis, and the issue is assessed as a moderate-priority confidentiality exposure rather than a critical emergency.
Authenticated users of Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 can read data, including personal information, beyond their assigned role permissions due to missing authorization checks on certain endpoints. The flaw requires a valid low-privilege account (PR:L) and network access but no user interaction or elevated privileges. No public exploit code has been identified at time of analysis, and this is best treated as a moderate-priority authenticated data-confidentiality exposure.
Missing authorization checks in Frappe ERPNext let authenticated users with low-privilege accounts read item master data outside their permitted role. The flaw affects all releases before 15.118.2 on the 15.x line and 16.x versions before 16.30.0, and is rooted in endpoints that skip server-side role enforcement (CWE-862). Exploitation requires valid credentials (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not reachable by fully unauthenticated attackers, and impact is confined to information disclosure with no write or availability effect; no public exploit identified at time of analysis, and vendor patches are available.
ERPNext instances before 15.115.0 (15.x) and before 16.26.0 (16.x) allow authenticated low-privileged users to modify inventory records through endpoints that omit role-based authorization checks (CWE-862), carrying a CVSS 4.0 base score of 7.1 (High) and an assessed CVSS 3.1 integrity-only impact. Exploitation requires a valid low-privilege ERPNext account and network access, with no confidentiality or availability impact per the vector; no public exploit identified at time of analysis. Vendor-released fixes are 15.115.0 and 16.26.0, and instances at or above those versions are not affected.
Stored cross-site scripting in Frappe ERPNext allows an authenticated low-privilege user to plant a malicious payload in a record field that is rendered into an HTML attribute context without escaping; the payload executes in the browser of any higher-privileged user who opens the affected page, which can lead to account takeover of that privileged session. Affected deployments are ERPNext before 15.119.0 and 16.x before 16.31.0, with patched releases 15.119.0 and 16.31.0 addressing the flaw. Exploitation requires an authenticated low-privilege account and depends on a victim with greater privileges passively opening the page, which is the primary limiting factor; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided, so this should be treated as a credible, actionable priority rather than an emergency.
Authenticated attackers with a common operational role can exploit a server-side template injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site. The vulnerability arises because user-controlled message fields are not validated before template rendering, allowing expressions to execute in an unrestricted context (CWE-1336). With a CVSS 4.0 score of 8.7, no public exploit has been identified at time of analysis, but the low privilege requirement makes this a credible priority for organizations running unpatched versions.
Missing authorization checks in certain Frappe ERPNext endpoints let authenticated low-privileged users read personal data beyond what their assigned role permits, affecting releases before 15.112.0 and the 16.x branch before 16.23.0. Because exploitation requires a valid low-privileged account (CVSS PR:L) rather than unauthenticated access, the practical risk is highest in deployments that expose portals or large numbers of low-trust accounts, such as customer/vendor portals, sizable employee bases, or multi-tenant hosting. The flaw is a confidentiality-only issue (CWE-862) with no integrity or availability impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 7.1 while our independent assessment rates it 7.5 under CVSS 3.1, reflecting its genuine but moderate-priority access-control nature.
SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 allows an authenticated attacker holding at least low-level application credentials to inject SQL into database queries through specific endpoints that fail to validate input, resulting in extraction of sensitive data from the underlying database. The vulnerability is confidentiality-only (CVSS:4.0 7.1 / assessed CVSS:3.1 7.1, C:H with I:N and A:N) - there is no integrity or availability impact, and exploitation is not possible anonymously, so broad internet scanning is ruled out. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is highest for internet-exposed instances that provision self-service or broadly distributed low-privilege accounts.
Authenticated SQL injection in Frappe ERPNext (before 15.106.0 and 16.x before 16.16.0) allows a low-privilege logged-in user to inject crafted input into several endpoints that build database queries without adequate validation, exposing sensitive data stored in the ERPNext database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, vendor score 7.1) confirms high confidentiality impact with no inherent integrity or availability effect, and authentication is mandatory, so risk is concentrated where low-privilege accounts are widely issued, self-registration is enabled, or instances are internet-facing. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the breadth of affected endpoints and the presence of a public GitHub security advisory make the issue operationally relevant for exposed, multi-tenant deployments.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 lets an authenticated low-privileged attacker read sensitive database information through specific endpoints that fail to validate input. Exploitation requires a valid low-privileged ERPNext session and network reachability to the affected instance; no user interaction or elevated privileges are needed, and patched 15.106.0/16.16.0 versions are not affected. There is no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
Missing authorization checks in Frappe ERPNext allow an authenticated user to create and modify records beyond what their assigned role permits, giving high integrity impact with no confidentiality or availability effect. Exploitation requires a valid ERPNext login with at least low privileges (CVSS PR:L), so fully unauthenticated outsiders cannot abuse it, and only deployments running versions before 15.119.0 or 16.x before 16.31.0 are affected. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, making this a moderate-priority integrity and access-control problem whose realistic risk is concentrated among insiders or anyone holding standard user credentials.
Authenticated low-privileged users in Frappe ERPNext (all versions before 15.119.0, and 16.x before 16.31.0) can read valuation and stock-costing data beyond what their assigned role permits, because specific endpoints fail to enforce authorization checks. Exploitation requires a valid low-privileged account (PR:L per the CVSS 4.0 vector) and network access to the application; the assessed impact is confidentiality-only (CVSS:3.1 C:H/I:N/A:N), so this is primarily an insider or compromised-account risk in multi-user or multi-tenant deployments rather than an unauthenticated intrusion path. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though a vendor security advisory and a third-party (VulnCheck) advisory are available.
Missing authorization checks in project-related endpoints of Frappe ERPNext allow any authenticated low-privilege user (CVSS v3.1 PR:L, remote, no user interaction) to read project data that their assigned role should not permit, resulting in a high-confidentiality, read-only disclosure with no integrity or availability impact. Affected deployments are ERPNext versions before 15.111.0 and 16.x before 16.22.0, with vendor patches available at 15.111.0 and 16.22.0; there is no public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). The practical risk is highest in multi-user or multi-tenant installations where semi-trusted or low-privileged accounts exist, since exploitation only requires a valid account and direct knowledge of the affected endpoint calls.
Authenticated users can modify records in Frappe ERPNext before 16.22.0 by invoking endpoints that omit proper authorization checks, allowing operations beyond their permitted role and resulting in unauthorized data modification. This missing authorization flaw (CWE-862) requires a valid low-privilege account and network access to the ERPNext web application, but no victim interaction; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms integrity impact only. No public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 allows an authenticated attacker holding a low-privilege account to read sensitive information from the backend database by sending crafted requests to specific endpoints that fail to validate input. The assessed impact is confidentiality-only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor CVSS 4.0 base 7.1), meaning data extraction rather than integrity or availability loss, and exploitation is gated by the need for a valid ERPNext session and reachability of the affected endpoints. No public exploit code has been identified at time of analysis and there is no KEV listing, but the low complexity of the attack and the availability of vendor advisories mean patched versions should be applied promptly.
SQL injection in Frappe ERPNext allows authenticated attackers to read sensitive data from the underlying database by sending specially crafted requests to endpoints that fail to validate user-supplied input. The flaw affects ERPNext releases before 15.110.0 and 16.x versions before 16.21.0, and exploitation requires a valid low-privilege session (CVSS PR:L), so it cannot be triggered by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation; the assessed risk is moderate-priority given the authentication barrier and the read-only confidentiality impact (C:H/I:N/A:N).
Missing authorization checks in Frappe ERPNext versions before 16.14.0 allow authenticated users to modify master data records that lie outside their assigned role, giving them write access they were never granted. The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H) confirms the issue is network-reachable but requires at least a low-privileged account; only data integrity is affected, with no confidentiality or availability impact. Per our assessment this is a legitimate but moderate-priority access-control gap rather than a critical emergency, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Upgrading to 16.14.0 removes the condition entirely.
Missing authorization in Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 allows authenticated low-privileged attackers to read financial data beyond their permitted role. The vulnerability is network-reachable with low attack complexity and requires only a valid low-privileged account, resulting in high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score is 7.1 (High).
Stored cross-site scripting in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows unauthenticated visitors to plant crafted HTML/script through a public-facing booking page; the payload is stored without neutralization and executes in the browser session of a privileged user who later views the booking content, enabling account takeover of that user. Exploitation is conditional: the instance must expose the public booking feature to untrusted submitters, and impact only completes when an authenticated, higher-privileged user opens the tainted content (UI:P in the CVSS 4.0 vector), so the attack is not fully automatable to immediate compromise and no public exploit code was identified at time of analysis. The vendor has released fixed versions, and this is a genuine priority for organizations that run the vulnerable booking workflow, not merely a high-score-on-paper issue.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 allow authenticated users with low privileges to call certain endpoints directly and read data beyond what their assigned role permits. The flaw is confidentiality-only (CWE-862, missing authorization): the CVSS v4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:N/VA:N) and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 7.1) agree that no data modification or denial of service is possible and that network access plus a valid low-privilege ERPNext account is required, with no user interaction. There is no public exploit identified at time of analysis, though the realistic threat population is insiders, compromised credentials, or environments that issue low-trust/portal logins, so the practical risk is moderate-priority exposure of sensitive ERP records rather than unauthenticated compromise.
SQL injection in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows an authenticated user with only low privileges to read sensitive data out of the underlying database by sending crafted input to endpoints that do not validate parameters before building SQL queries. Unauthenticated and anonymous users cannot trigger the flaw - a valid ERPNext session is required (PR:L), and the impact is limited to confidentiality (high data disclosure, no integrity or availability loss), which caps the practical severity despite the 7.1 CVSS v4.0 base score. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence; the principal exposure is any production instance running an affected version with normal user accounts.
Missing authorization checks in Frappe ERPNext allow an authenticated low-privileged user to invoke status-modification endpoints that omit proper role enforcement, altering record status and business data beyond the attacker's assigned role. Affected versions are ERPNext before 15.121.0 and 16.x before 16.34.0; exploitation requires a valid ERPNext account with at least low privileges (CVSS PR:L) and is reachable over the network, but carries no confidentiality or availability impact, making it primarily an integrity-focused insider or post-account-compromise escalation path. No public exploit code has been identified and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not available in the provided intelligence. Vendor-released fixes are available in 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 allow an authenticated user holding only a low-privileged role to bypass role-based access control and read financial data by issuing direct requests to specific endpoints. The affected vector is network-reachable with low complexity but requires a valid account (PR:L), and the impact is limited to read-only confidentiality loss - no data modification or denial of service is possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so it is a moderate-priority broken access control flaw rather than an emergency; patched instances and deployments restricted to trusted users carry substantially reduced practical risk.
Authenticated SQL injection in Frappe ERPNext before 16.34.2 allows users holding only low-privilege accounts to send crafted requests to multiple application endpoints and read sensitive data out of the underlying database. The flaw is a missing input validation issue (CWE-89) that is remotely reachable without user interaction, but it is gated behind the need for valid low-privilege credentials, which limits it to a moderate, authentication-dependent risk rather than an anonymous internet-wide exposure; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing role-based authorization enforcement in Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 lets any authenticated user read financial data that their assigned role should not permit. Because the vulnerable endpoints can be requested directly over the network with any valid low-privilege account and require no user interaction or non-default configuration, the practical risk is malicious insiders or attackers operating with stolen, shared, or weak credentials rather than anonymous outsiders. Impact is confidentiality-only (no data modification or availability loss), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released fixed versions 15.121.3 and 16.35.0.
Missing authorization enforcement in Frappe ERPNext endpoints lets authenticated low-privileged users read personal data beyond the scope their assigned role permits, affecting releases before 15.120.0 and 16.x before 16.33.0. The flaw is network-reachable and requires only a valid session for a minimal role, as reflected in the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N with confidentiality-only impact (C:H, I:N, A:N) and a CVSS 4.0 base score of 7.1; unauthenticated attackers cannot exploit it. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a moderate-priority access-control defect rather than a critical remote-code compromise, with the main risk being unauthorized disclosure of employee, customer, or contact records held in the ERP.
Frappe ERPNext instances running releases before 15.120.0, or 16.x releases before 16.23.0, contain an authorization bypass that allows any authenticated user - including a low-privilege account - to read party records outside the scope of their assigned role. The affected endpoint honours a caller-supplied flag that is meant to disable its own permission enforcement, so simply setting that flag in the request causes the server to skip the role check entirely; the result is a read-only confidentiality exposure with no write, modification, or availability impact. No public exploit code has been identified at time of analysis, but exploitation requires only a valid session and is most consequential on multi-user or multi-tenant deployments where party data is meant to be segregated by role, making this a legitimate but moderate-priority issue rather than a top-tier emergency.
Authenticated low-privileged users can create documents beyond their permitted roles in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0, because certain document-creation endpoints omit the role-based authorization checks the Frappe permission model normally enforces. The flaw is a CWE-862 missing authorization issue scored CVSS 4.0 7.1 (an independent CVSS 3.1 assessment also returns 7.1), with high integrity impact and low confidentiality impact, requiring only a valid low-privilege account (PR:L) and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, but deployments that permit self-registration or issue portal/customer accounts widen the realistic attacker pool.
Missing authorization checks in Frappe ERPNext before 15.121.3 and in 16.x before 16.35.0 allow any authenticated user - including a low-privilege or self-registered account - to send requests to certain endpoints and modify data beyond what their assigned role permits. Authentication is mandatory (PR:L in the assessed vector), so anonymous remote exploitation is not possible; risk is concentrated in deployments with many distinct user roles, untrusted or self-registered users, or exposure to credential compromise. There is no public exploit identified at time of analysis and no CISA KEV entry, and the vendor has released fixed versions in the 15.x and 16.x lines.
Missing authorization in Frappe ERPNext document-creation endpoints (all versions before 15.121.0, and 16.x before 16.34.0) lets any authenticated low-privileged user - a portal, employee, or customer self-service account - create documents against records beyond their permitted role, bypassing role-based access controls. Impact is confined to integrity: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) and our independent CVSS 3.1 assessment of 7.1 (I:H, C:N, A:N) both show unauthorized document creation with no data disclosure or service disruption. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, while vendor-released fixes exist in ERPNext 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 16.34.0 allow any authenticated user to read financial records - accounting, ledger and invoice data - that their assigned role should not permit, resulting in a confidentiality-only breach. Exploitation requires only a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 7.1) and network reachability to the instance; no admin rights, user interaction, or special configuration are needed, which scopes the practical risk toward insiders or attackers holding stolen or self-registered low-trust accounts. No public exploit code has been identified at time of analysis, and CVE-2026-109614 is not confirmed actively exploited (CISA KEV); it is assessed as a credible but moderate-priority issue rather than a critical emergency.
Missing authorization checks in Frappe ERPNext document-status modification endpoints allow authenticated low-privileged users to alter records beyond their assigned roles, with the primary impact being high integrity loss and limited availability impact (CVSS 4.0 7.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:L). Only instances running the 15.x branch below 15.121.0 or the 16.x branch below 16.34.0 are affected, and exploitation requires a valid low-privilege account plus reachability and knowledge of the relevant status endpoints - no administrative access or anonymous path exists, and confidentiality is unaffected. This is a genuine but moderate-priority issue rather than a critical emergency; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
Stored cross-site scripting in Frappe ERPNext allows any authenticated user with permission to create records to plant a crafted record name that is later rendered unescaped in a report view, executing arbitrary script in the browser session of whichever user opens that report. Exploitation is not remote-unauthenticated: it requires valid credentials plus create-record rights (CVSS 4.0 PR:L) and is further gated on a second user subsequently opening the vulnerable report (UI:P), meaning the payload lies dormant until then. Impact spans the confidentiality and integrity of the affected session and can be severe when a high-privileged administrator views the report; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the issue is rated 8.5 and warrants prompt patching.
Authenticated low-privileged users can modify documents and data beyond their assigned role permissions in Frappe ERPNext before 15.119.1 and in 16.x before 16.32.0, because certain endpoints fail to enforce proper permission checks (CWE-862, Missing Authorization). The issue is rated CVSS 4.0 7.1 (CVSS:3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - integrity-only impact with no confidentiality or availability effect - and exploitation requires a valid ERPNext session for a low-privileged account plus knowledge of the specific unguarded endpoints, so it is not reachable by anonymous or unauthenticated attackers. There is no CISA KEV listing and no public exploit identified at time of analysis; realistic risk is confined to malicious insiders or attackers who already hold low-privilege credentials, and vendor-released fixes are available in 15.119.1 and 16.32.0.
SQL injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 allows authenticated attackers with low privileges to extract sensitive information from the database via crafted requests to endpoints lacking input validation. The vulnerability is not known to be actively exploited, and no public exploit code has been identified at time of analysis. With a CVSS 4.0 score of 7.1, exploitation requires network access and valid low-privilege credentials, making it a significant risk for insiders or compromised accounts in multi-tenant deployments.
SQL injection in Frappe ERPNext 15.x before 15.121.0 and 16.x before 16.34.0 lets any authenticated user, including an account with no assigned roles, inject crafted parameters into several endpoints that lack input validation, read other users' sensitive information, and escalate to a privileged account. Because only the lowest privilege level is needed (CVSS 4.0 PR:L; independently assessed at 8.7 under a 3.1 vector of AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact), deployments that permit self-registration or hand out broad low-privilege accounts face a nearly trivial authentication barrier, while tightly controlled instances still require a valid login. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory is public, so unpatched, internet-reachable instances should be treated as high priority.
Stored cross-site scripting in Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 allows an authenticated user who can create the affected record type to embed script in a record name, which is then interpolated unescaped into markup by a tool view and executed in the browser session of any user who later opens that tool. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that exploitation is authentication-gated at low privileges and depends on victim interaction, making this a moderate-priority, insider-reachable issue rather than an unauthenticated emergency; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because the payload persists in stored data, a single malicious record name can affect every user who subsequently visits the vulnerable tool view, so scope is limited to session-level script execution in the victim's context rather than direct server compromise.
SQL injection in ERPNext's Inactive Customers report allows any authenticated user to manipulate raw database queries via an unvalidated doctype filter parameter. Affected versions prior to 15.116.0 (v15 branch) and 16.23.0 (v16 branch) interpolate user-supplied input directly into f-string SQL in get_sales_details and get_last_sales_amt, enabling exfiltration of sensitive ERP data and limited database manipulation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Server-side template injection in ERPNext (Frappe framework) lets low-privileged authenticated users escape the Frappe safe-execution sandbox and achieve remote code execution on the server. The root cause is that frappe.render_template was exposed inside the safe_exec globals without forcing restrict_globals, so a user who can supply template content crosses a permission boundary into unrestricted Jinja evaluation. Rated CVSS 9.9 with a scope change; no public exploit code or CISA KEV listing is identified at time of analysis, but the fix commit is public, narrowing the reversing effort required.
Improper authorization in ERPNext's CRM module allows authenticated low-privileged users to retrieve CRM opportunity data beyond their permitted scope via the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. Versions before 15.115.0 and before 16.26.0 are affected, with patches now available from Frappe. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-privilege, network-accessible nature of the flaw makes it a realistic insider threat or credential-abuse vector.
Server-side template injection in Frappe ERPNext (versions before 15.111.0 and 16.22.0) lets an authenticated user holding only a standard operational role inject a malicious template payload into a configuration field, causing the server to render it and disclose data the user is not authorized to see. Because the flaw is rooted in an authorization failure (CWE-863), it effectively bypasses ERPNext's role/permission boundaries. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a fixed release is available from the vendor.
SQL injection in ERPNext versions prior to 16.9.0 allows authenticated remote attackers to extract sensitive data by sending specially crafted requests to vulnerable endpoints. The Frappe-maintained ERP platform requires low-privileged authentication (PR:L) but has high impact on confidentiality, integrity, and availability per CVSS 8.8. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%).
SQL injection in ERPNext (Frappe's open-source ERP platform) prior to 15.104.3 and 16.14.0 allows authenticated remote attackers to extract sensitive database contents by sending crafted requests to vulnerable endpoints. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though EPSS sits at 0.04% and SSVC reports no observed exploitation, indicating this is a high-severity but currently unexploited issue. No public exploit identified at time of analysis.
Privilege escalation in ERPNext versions prior to 16.9.1 allows authenticated low-privileged users to modify data outside their assigned role due to missing authorization checks on certain endpoints. The flaw carries a CVSS 9.9 score with scope change, but EPSS is only 0.04% and CISA SSVC reports no observed exploitation, indicating no public exploit identified at time of analysis. The vendor (Frappe) has released a patched version 16.9.1 alongside GHSA-cg5w-7g26-p3w9.
A blind SQL injection vulnerability exists in ERPNext, a free and open-source Enterprise Resource Planning system, affecting versions prior to 15.100.0 and beta versions 16.0.0-beta.1 through 16.7.x. The vulnerability allows authenticated attackers with low-level privileges to perform time-based and boolean-based blind SQL injection attacks through insufficiently validated parameters on certain endpoints, enabling them to infer and extract sensitive database information. This is tagged as an SQLi vulnerability and has been assigned EUVD-2026-13547 by ENISA, with patches available in versions 15.100.0 and 16.8.0.
Missing authorization in ERPNext ERP before 15.98.0/16.6.0. Patch available.
ERPNext instances prior to 15.118.0 (v15 branch) and 16.27.0 (v16 branch) expose financial data through the Sales Person-wise Transaction Summary report because the report's server-side query omits the requesting user's document-permission match conditions. An authenticated attacker holding only a limited role that can run this report can read Sales Order/Sales Invoice, Sales Team, and item-level financial rows for records the role should never see, resulting in a high-confidentiality, read-only disclosure (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; CWE-862 Missing Authorization). No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, so risk is driven by the low exploitation complexity for any logged-in low-privilege user rather than by observed attacks.
Stored cross-site scripting in Frappe ERPNext (15.x before 15.110.0 and 16.x before 16.21.0) lets an authenticated user who holds write access to item master data persist JavaScript inside a record name, which is then rendered without escaping and executes in the browser of any operator who opens the affected item page. Exploitation requires an existing account with item-write privileges plus a second user later viewing the poisoned record, so it is an insider- or compromised-account scenario rather than a remote unauthenticated attack, and the impact is confined to the viewing operator's browser session rather than the ERPNext server. Severity is moderate (CVSS 4.0 base 5.1; independent assessment 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), no public exploit code and no confirmed active exploitation were identified at time of analysis, and upgrading to 15.110.0 or 16.21.0 removes the condition.
Missing authorization checks in Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 let an authenticated low-privileged user change the status of records they should not be able to touch, bypassing role-based access restrictions. The flaw carries a vendor/VulnCheck CVSS 4.0 base score of 5.3 (moderate) and requires a valid low-privileged session, so exploitation is limited to insiders or holders of legitimately provisioned low-tier accounts; impact is integrity-only, with no confidentiality or availability effect. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited (no CISA KEV listing); vendor patches are available in 15.110.0 and 16.21.0, so the practical priority is moderate - patch on a normal maintenance cadence.
Missing authorization checks in Frappe ERPNext party-record endpoints let any authenticated user with a low-privileged role modify party records beyond what their role permits. Affected deployments are ERPNext versions before 15.110.0 and 16.x releases before 16.21.0; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.3) confirms the attack requires a valid low-privileged account and results in limited integrity impact only, with no confidentiality or availability effect. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium/low-priority hardening issue rather than an urgent one, and instances already on 15.110.0 or 16.21.0+ are unaffected.
Authenticated users holding only low-privilege roles in Frappe ERPNext can call specific endpoints that fail to enforce role-based permission checks, allowing them to deactivate master records outside their assigned permissions. The flaw affects ERPNext releases before 15.108.0 and 16.x before 16.18.0 and carries a moderate 5.3 severity, with impact confined to the integrity of master data - the assessed vector shows no confidentiality loss, no availability impact, and no scope change. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (not listed in CISA KEV).
Authenticated users in Frappe ERPNext deployments before 15.112.0 can bypass role-based record permissions by calling specific endpoints that lack proper authorization validation, allowing them to modify individual fields on record types they are not permitted to edit. This is a medium-severity (CVSS 5.3) broken-access-control flaw (CWE-862) with integrity-only impact and no confidentiality or availability loss; no public exploit identified at time of analysis. A vendor security advisory (GHSA-f7x9-qfrf-92m8) and VulnCheck advisory provide further details.
Stored cross-site scripting in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) lets unauthenticated attackers inject crafted markup through a publicly exposed portal form that saves submissions for later back-office review; the payload executes in the browser of the authenticated staff member who opens the stored record. Because the CVSS 4.0 vector carries PR:N, the entry point is unauthenticated, but exploitation is not self-triggering - a human review action is a hard prerequisite (UI:P), and impact is confined to the reviewing user's browser session (SC:L/SI:L) with no direct server-side confidentiality, integrity, or availability loss (VC:N/VI:N/VA:N). Rated 5.3 (medium), with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); vendor-released patches exist in ERPNext 15.112.0 and 16.23.0.
Stored cross-site scripting in Frappe ERPNext 16.x before 16.27.0 allows an authenticated user who holds edit (write) rights on a document type to set a record's name field to a script payload that the application later renders without HTML escaping. The script executes in the browser of any colleague who subsequently opens the affected record page, enabling session-context actions such as data theft or UI manipulation within that victim's ERPNext session. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 16.27.0, so this is a genuine but limited medium-severity issue rather than an urgent emergency.
Authenticated low-privileged users can cause ERPNext to send transactional emails for documents they are not permitted to read, due to missing authorization checks in certain endpoints. This affects ERPNext before 15.119.0 and 16.x before 16.31.0. The vulnerability is not known to be actively exploited, no public exploit code has been identified, and the CVSS 3.1 base score is 5.3 (moderate), with limited confidentiality and integrity impact.
Server-side request forgery in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) allows an authenticated user holding a common operational role to point a writable configuration field at an arbitrary destination, causing the ERPNext server to issue outbound requests to hosts that are only reachable from inside the deployment's network. The issue is rated CVSS 5.3 and requires a valid session with permissions to edit the affected field (PR:L), so it is not exploitable by fully unauthenticated attackers; real-world impact depends entirely on what internal services - such as cloud metadata endpoints, internal APIs, or databases - are reachable from the application server. No public exploit code has been identified and the flaw is not confirmed as actively exploited (no CISA KEV listing); per our assessment this is a moderate, not urgent, priority that is fully resolved by upgrading to a fixed release.
Missing authorization checks in certain Frappe ERPNext endpoints allow any authenticated user to read records beyond the scope their assigned role should permit, exposing data that role-based access control is intended to restrict. The flaw affects ERPNext versions before 15.110.0 and 16.x before 16.21.0 and is exploitable only by a logged-in user holding at least a low-privilege account (CVSS PR:L, assessed CVSS 3.1 base 5.3); it is not reachable by unauthenticated attackers, and impact is limited to confidentiality since no integrity or availability effects were identified. Vendor patches are available in 15.110.0 and 16.21.0, and no public exploit identified at time of analysis.
Unauthenticated remote attackers can invoke specific Frappe ERPNext endpoints that fail to enforce authorization checks, allowing them to create records and enumerate availability even when an administrator has disabled the corresponding feature. The flaw affects ERPNext before 15.110.0 and 16.x before 16.21.0, is classified as CWE-862 (missing authorization), and carries a moderate risk profile (6.9 CVSS v4.0; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) with impact bounded to low-integrity and low-availability effects and no data disclosure, code execution, or privilege escalation. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation is nonetheless trivial for any network-reachable instance because no authentication, user interaction, or special conditions are required.
Missing authorization in Frappe ERPNext versions before 15.105.0 and 16.x before 16.15.0 allows an authenticated low-privilege portal user to create documents on behalf of other parties, compromising data integrity. The flaw affects document-creation endpoints that fail to verify the requesting portal user belongs to the target party. No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate access-control issue requiring a valid portal account.
SQL injection in Frappe ERPNext (before 15.121.0 and 16.x before 16.34.0) allows an authenticated user holding high privileges to send specially crafted requests to endpoints that lack input validation, injecting SQL that lets them read sensitive information from the underlying database. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, only confidentiality is affected - data can be read but not modified or destroyed - and the attacker must already hold an elevated/administrative account, which confines realistic risk to insiders or environments where a privileged account has been compromised. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency; vendor patches exist in 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 15.121.0 and in 16.x before 16.34.0 let an authenticated user call certain endpoints that do not enforce role-based permission rules, exposing records the account's role should not be able to read. Exploitation requires valid credentials or an active session as a lower-privileged user (PR:L per the CVSS vector), and the impact is confined to unauthorized data disclosure - no modification, deletion, or code execution is possible through this flaw. Independent assessment rates it medium severity (CVSS 3.1 5.3), and no public exploit code has been identified at time of analysis; the practical risk scales with how many low-trust or untrusted authenticated accounts exist in a given deployment and how sensitive the role-restricted data is.
Authenticated users of Frappe ERPNext (before 15.121.3 and 16.x before 16.35.0) can abuse a transactional-email endpoint to send arbitrary messages through the site's own configured outgoing mail account, because the endpoint does not verify the caller's authorization before dispatching mail. Any low-privilege account is sufficient - no admin role or special permission is required - and the site must simply have an outgoing email account configured, which is the default for a functioning ERPNext deployment. The result is email relay abuse under the organisation's trusted sending identity, useful for phishing, spam, or reputational damage rather than data theft or service disruption; the assessed impact is limited to low integrity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Missing authorization enforcement in certain Frappe ERPNext endpoints allows an authenticated user holding only low-privilege role access to modify documents and records beyond the permissions assigned to their role, affecting all releases before 15.121.1 and 16.x before 16.34.2. Exploitation requires valid ERPNext credentials and the ability to reach the affected endpoints, but no user interaction and no non-default configuration - the flaw lies in the endpoints' own failure to check roles (CWE-862). Impact is bounded to low confidentiality and low integrity effects with no availability impact, no public exploit code has been identified at time of analysis, and the vendor has released patched versions (see advisory GHSA-49wp-r82c-j825).
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 allow authenticated users to modify data beyond their permitted role, compromising data integrity with no confidentiality or availability impact. Exploitation requires a valid low-privilege ERPNext account (PR:L) and reachable endpoints that fail to enforce role-based authorization; anonymous access is not possible, and no public exploit identified at time of analysis. This is a moderate-severity broken access control issue, not a critical flaw.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 let authenticated users with low-privilege roles modify data beyond their assigned permissions through certain network-reachable endpoints. According to the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), exploitation requires a valid authenticated session and results only in limited integrity impact, with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the vendor has released fixed versions 15.121.0 and 16.34.0.
Reflected cross-site scripting in Frappe ERPNext (all versions before 14.92.1, and 15.x before 15.83.0) lets an attacker inject arbitrary JavaScript that runs inside an authenticated user's session, enabling session/account takeover. The attacker needs no credentials (PR:N in the CVSS vectors), but exploitation requires a logged-in victim to follow a crafted URL (UI:P), so it is delivered by phishing or social engineering rather than by a direct server-side attack. Impact is rated high for confidentiality and integrity (VC:H/VI:H) with scope change under the CVSS 4.0 vector (8.6) and CVSS 3.1 equivalent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N); there is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is lower priority than a zero-interaction network RCE.
pacioli-guard 0.9.6 fails to check that a consent marker actually authorizes a cancellation, so a nested Document.cancel() call can ride a valid human-minted submit marker belonging to an enclosing governed act and reverse the ledger effect of a different, caller-named pre-existing submitted document such as a Sales Invoice. The flaw is an incorrect-authorization defect (CWE-863) that bypasses the marker's document binding, act binding, single-use spend accounting, and denial audit, and it is reachable by an authenticated API-key credential holding Scope.require_consent (PR:L) only after a legitimate human has minted the enclosing submit marker (UI:R), which is why it rates a medium CVSS 5.7. Principals without a consent-gated grant are explicitly unaffected, and no public exploit has been identified at time of analysis - there is no CISA KEV listing for this CVE.
Authenticated users holding the ERPNext Accounts Manager role can invoke arbitrary non-whitelisted server-side Python methods and read back their return values in Frappe ERPNext versions before 16.34.1. The flaw lives in Financial Report Template handling: a Custom API row's calculation_formula is passed straight to frappe.call() without verifying that the dotted path resolves to a whitelisted, GET-permitting method, so an attacker with rights to create or edit such templates can point the formula at internal methods that were never meant to be remotely callable. The assessed impact is limited information disclosure and limited integrity impact (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; CVSS 4.0 5.3), exploitation requires a privileged non-default role, no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data indicates active exploitation. This is a genuine but modest-severity issue best treated as medium-low priority.
SQL injection in ERPNext's tax rule engine allows any authenticated low-privilege user to extract arbitrary database content. The get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py directly interpolated request-supplied posting_date and args dictionary values into raw SQL WHERE clauses via Python f-strings and .format() calls, bypassing all parameterization. Vendor-released patches exist as versions 15.109.0 and 16.20.0; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization in ERPNext's account creation function allows any authenticated low-privilege user to bypass the Account doctype's create permission gate and insert unauthorized chart-of-accounts entries, directly corrupting financial data integrity and audit trails. All ERPNext releases prior to v15.111.0 (v15 branch) and v16.22.0 (v16 branch) are affected, as confirmed by vendor security advisory GHSA-94v6-784v-24q5 and the published PR diff. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in ERPNext's Process Statement of Accounts module allows any authenticated low-privilege user to invoke the send_emails function and dispatch automated account statement emails to customers without holding the required role. Versions prior to 15.111.0 (v15 branch) and 16.22.0 (v16 branch) are affected across all ERPNext deployments using this accounts feature. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the vendor has released confirmed patches for both active version branches.
Stored cross-site scripting in ERPNext 16.16.0 allows an authenticated user holding Item record edit permissions to persist malicious HTML/JavaScript in the item_name, description, or image fields, which executes unescaped in the Point of Sale (POS) cart interface for any operator who subsequently adds that item to a transaction. Reported by Fluid Attacks (EUVD-2026-34158), this is a stored XSS with lateral impact across all POS operator sessions exposed to the poisoned item record. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 4.8 reflects the constrained attack surface imposed by high privilege prerequisites and required passive user interaction.
Stored cross-site scripting in ERPNext 16.16.0 allows authenticated users to inject arbitrary HTML and JavaScript into the email_id or mobile_no fields of Customer records, which execute silently in the browser of every Point of Sale (POS) operator who subsequently selects the poisoned customer. Because the payload persists in the database, a single injection event affects all future POS operator sessions that encounter that customer - creating a multiplier effect without requiring repeated attacker access. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided in available intelligence sources.
Insufficient authorization enforcement on specific ERPNext endpoints allows authenticated low-privilege users to read sensitive data beyond their permitted role and make limited unauthorized data modifications. Affecting all ERPNext deployments prior to 15.102.0 (v15 branch) and prior to 16.11.0 (v16 branch), an attacker holding any valid user account can invoke unprotected server-side endpoints to access restricted records or alter data outside their role scope. No public exploit code exists and SSVC confirms no active exploitation, but the high confidentiality impact (CVSS C:H) warrants prompt patching - particularly on internet-exposed ERPNext instances where low-privilege accounts may be broadly distributed.
XML External Entity (XXE) injection in ERPNext's EDI Module allows authenticated low-privilege attackers to read arbitrary files from the server's local filesystem, including sensitive configuration files that may contain database credentials or API keys. Affected are all ERPNext installations on the v15 branch prior to 15.104.3 and on the v16 branch prior to 16.12.0 (cpe:2.3:a:frappe:erpnext:*). No public exploit identified at time of analysis, EPSS exploitation probability sits at 0.06% (18th percentile), and CISA SSVC assesses exploitation as none and the attack as non-automatable - collectively placing this at lower operational priority despite its network-accessible attack vector.
Server-Side Request Forgery (SSRF) in ERPNext allows an authenticated remote attacker to send a crafted request to a vulnerable endpoint, causing the ERPNext server to issue arbitrary outbound HTTP calls to attacker-controlled services. The CVSS Changed scope (S:C) indicates the impact extends beyond the application itself, enabling potential access to internal network resources, cloud metadata services, or other intranet endpoints not otherwise reachable by the attacker. Vendor-released patches exist in versions 15.106.0 and 16.16.0; no active exploitation has been confirmed (not listed in CISA KEV) and EPSS sits at a very low 0.02%.
Path traversal in ERPNext exposes arbitrary server files to authenticated low-privileged users via a vulnerable endpoint that fails to restrict directory access. Affected versions are ERPNext prior to 15.101.1 and the 16.x beta line prior to 16.10.0, packaged under CPE cpe:2.3:a:frappe:erpnext. An attacker with a valid account can craft a request to read sensitive files outside the intended directory scope, resulting in full confidentiality compromise of the host filesystem. No public exploit identified at time of analysis, and CISA SSVC signals no active exploitation.
Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. [CVSS 4.1 MEDIUM]
Missing authorization checks in ERPNext versions prior to 15.121.0 and 16.34.0 let any authenticated user with a low-privilege role invoke state-changing whitelisted endpoints - such as Ledger Merge, Process Period Closing Voucher start/pause/cancel, Repost Payment Ledger, Delivery Note sales return, payment order, and bulk transaction processing - without the write, submit, cancel, or role permissions those operations should require, allowing tampering with financial and transactional records beyond the user's assigned role. The flaw is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so exploitation requires a valid low-privileged account but no admin rights, no user interaction, and no non-default configuration; integrity impact is high while confidentiality is unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the attack surface is standard functionality present in every affected deployment, so multi-user or internet-exposed instances should treat this as high priority. Vendor-released patch: 15.121.0 and 16.34.0.
SQL injection in Frappe ERPNext releases before 15.98.0 and 16.x before 16.6.0 lets remote attackers who already hold a valid application session inject crafted input into a subset of endpoints and manipulate backend database queries, reading sensitive records the account would not otherwise be able to access. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the primary limiting factor is authentication: a low-privilege ERPNext account is required, but no user interaction and no non-default configuration are needed, so default deployments on the affected versions are exposed to any logged-in user. Impact is confined to confidentiality - no integrity or availability effect - which keeps this a credible but moderate-priority issue rather than an emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing). Exposure is highest for internet-facing ERPNext instances that offer self-service registration or lightly provisioned accounts.
Stored cross-site scripting in Frappe ERPNext allows an authenticated user with permission to create or rename records to plant script payloads in record names that are later rendered without proper neutralization on certain dashboards, tools, and portal pages. Versions before 15.103.0 and 16.x before 16.12.0 are affected; the vulnerability scores CVSS 4.0 8.5 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N) and the independent assessment rates it a credible, above-average-priority issue rather than an emergency, because a valid low-privilege login is mandatory, the payload only fires when a victim - ideally a privileged user - opens the specific affected view, and the attacker cannot control exact timing. Successful exploitation can read or modify data and steal session tokens from other users' browsers; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Installations running 15.103.0+ or 16.12.0+ are not vulnerable.
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 allows authenticated low-privilege users to read financial data beyond their assigned role because certain endpoints do not enforce proper authorization checks (CWE-862). The vulnerability is remote and requires valid ERPNext credentials (PR:L) with no user interaction, but impact is limited to high confidentiality read exposure with no write or availability effect; no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than a top-tier emergency, with practical risk highest in broad-user-base or multi-tenant deployments where many low-privilege or portal accounts can reach the affected endpoints.
Stored cross-site scripting in Frappe ERPNext (before 15.113.0 and 16.x before 16.24.0) allows an authenticated low-privilege user to persist malicious script in a profile field that is rendered without escaping into portal pages; the payload executes in the browser of any administrator viewing those pages, enabling administrator account takeover. Exploitation requires a low-privilege account with access to edit the vulnerable profile field - realistic where ERPNext exposes self-service portal/website accounts for customers or suppliers - plus administrator interaction to load the poisoned page, which bounds risk below that of a pre-authentication, zero-interaction XSS. No public exploit code was identified at time of analysis.
Privilege escalation in Frappe ERPNext lets any authenticated user - including one holding no operational role - create privileged records such as user accounts and role assignments, ultimately taking full control of the site. The flaw affects releases before 15.111.0 and 16.x before 16.22.0, and stems from a record-creation endpoint that derives the record type from the request and inserts it with permission checks disabled; the only prerequisite is a valid login (CVSS 4.0 vector PR:L, i.e. authenticated, no user interaction, no non-default configuration). Rated 8.7 with high confidentiality, integrity and availability impact across the vulnerable site, and no public exploit code has been identified at time of analysis.
Frappe ERPNext fails to enforce permission checks on certain inventory-record endpoints, letting any authenticated user - regardless of assigned role - modify stock and inventory data they should not be able to touch. The flaw affects releases before 15.110.0 and 16.x before 16.21.0, requires a valid ERPNext session (CVSS PR:L, not anonymous), and impacts data integrity only: there is no disclosure of records and no denial of service. It is a moderate-priority authorization defect rather than a critical emergency, and no public exploit code has been identified at time of analysis; vendor fixes are available in 15.110.0 and 16.21.0. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
SQL injection in Frappe ERPNext (15.x before 15.113.0 and 16.x before 16.22.0) allows attackers with a valid ERPNext account to inject crafted parameters into database queries and read sensitive records from the underlying database. Exploitation requires an authenticated session over the network and no user interaction; the flaw yields high confidentiality impact with no integrity or availability impact. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the primary risk driver is the availability of low-privilege accounts - risk rises sharply where self-service or open registration is enabled or where the instance is internet-exposed.
Frappe ERPNext instances running versions before 15.116.0, or 16.x before 16.27.0, expose financial data to any user who can authenticate, because specific endpoints omit the role-based authorization checks that should gate them. An attacker holding a valid but low-privileged account can query those endpoints directly and read financial records that their role does not permit, resulting in high confidentiality impact with no integrity or availability effect. Exploitation requires authentication (CVSS PR:L) and no user interaction, so the realistic threat is a malicious or compromised insider, portal user, or leaked low-privilege credential rather than an anonymous internet drive-by; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Missing authorization checks in Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 let an authenticated, low-privileged user reach specific endpoints that modify production records and change data beyond the scope of their assigned role. Because the flaw is an integrity-only problem (CVSS:4.0 7.1; VI:H, VC:N, VA:N), attackers cannot read protected data or disrupt availability - they can only tamper with production/manufacturing records they should not be able to touch. Exploitation requires a valid low-privileged account and knowledge of the affected endpoint paths (PR:L per the assessed CVSS:3.1 vector); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but moderate-priority issue rather than a critical emergency.
Missing authorization checks in Frappe ERPNext 15.x before 15.113.0 and 16.x before 16.24.0 allow any authenticated user to call affected endpoints that omit role validation and read financial records their assigned permissions do not cover. Exploitation requires a valid ERPNext session (CVSS PR:L), so the practical threat is a low-privilege insider, malicious employee, or compromised portal account rather than an anonymous internet attacker, and the outcome is limited to data disclosure with no modification or service disruption. No public exploit code has been identified at time of analysis, and the issue is assessed as a moderate-priority confidentiality exposure rather than a critical emergency.
Authenticated users of Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 can read data, including personal information, beyond their assigned role permissions due to missing authorization checks on certain endpoints. The flaw requires a valid low-privilege account (PR:L) and network access but no user interaction or elevated privileges. No public exploit code has been identified at time of analysis, and this is best treated as a moderate-priority authenticated data-confidentiality exposure.
Missing authorization checks in Frappe ERPNext let authenticated users with low-privilege accounts read item master data outside their permitted role. The flaw affects all releases before 15.118.2 on the 15.x line and 16.x versions before 16.30.0, and is rooted in endpoints that skip server-side role enforcement (CWE-862). Exploitation requires valid credentials (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not reachable by fully unauthenticated attackers, and impact is confined to information disclosure with no write or availability effect; no public exploit identified at time of analysis, and vendor patches are available.
ERPNext instances before 15.115.0 (15.x) and before 16.26.0 (16.x) allow authenticated low-privileged users to modify inventory records through endpoints that omit role-based authorization checks (CWE-862), carrying a CVSS 4.0 base score of 7.1 (High) and an assessed CVSS 3.1 integrity-only impact. Exploitation requires a valid low-privilege ERPNext account and network access, with no confidentiality or availability impact per the vector; no public exploit identified at time of analysis. Vendor-released fixes are 15.115.0 and 16.26.0, and instances at or above those versions are not affected.
Stored cross-site scripting in Frappe ERPNext allows an authenticated low-privilege user to plant a malicious payload in a record field that is rendered into an HTML attribute context without escaping; the payload executes in the browser of any higher-privileged user who opens the affected page, which can lead to account takeover of that privileged session. Affected deployments are ERPNext before 15.119.0 and 16.x before 16.31.0, with patched releases 15.119.0 and 16.31.0 addressing the flaw. Exploitation requires an authenticated low-privilege account and depends on a victim with greater privileges passively opening the page, which is the primary limiting factor; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided, so this should be treated as a credible, actionable priority rather than an emergency.
Authenticated attackers with a common operational role can exploit a server-side template injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site. The vulnerability arises because user-controlled message fields are not validated before template rendering, allowing expressions to execute in an unrestricted context (CWE-1336). With a CVSS 4.0 score of 8.7, no public exploit has been identified at time of analysis, but the low privilege requirement makes this a credible priority for organizations running unpatched versions.
Missing authorization checks in certain Frappe ERPNext endpoints let authenticated low-privileged users read personal data beyond what their assigned role permits, affecting releases before 15.112.0 and the 16.x branch before 16.23.0. Because exploitation requires a valid low-privileged account (CVSS PR:L) rather than unauthenticated access, the practical risk is highest in deployments that expose portals or large numbers of low-trust accounts, such as customer/vendor portals, sizable employee bases, or multi-tenant hosting. The flaw is a confidentiality-only issue (CWE-862) with no integrity or availability impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 7.1 while our independent assessment rates it 7.5 under CVSS 3.1, reflecting its genuine but moderate-priority access-control nature.
SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 allows an authenticated attacker holding at least low-level application credentials to inject SQL into database queries through specific endpoints that fail to validate input, resulting in extraction of sensitive data from the underlying database. The vulnerability is confidentiality-only (CVSS:4.0 7.1 / assessed CVSS:3.1 7.1, C:H with I:N and A:N) - there is no integrity or availability impact, and exploitation is not possible anonymously, so broad internet scanning is ruled out. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is highest for internet-exposed instances that provision self-service or broadly distributed low-privilege accounts.
Authenticated SQL injection in Frappe ERPNext (before 15.106.0 and 16.x before 16.16.0) allows a low-privilege logged-in user to inject crafted input into several endpoints that build database queries without adequate validation, exposing sensitive data stored in the ERPNext database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, vendor score 7.1) confirms high confidentiality impact with no inherent integrity or availability effect, and authentication is mandatory, so risk is concentrated where low-privilege accounts are widely issued, self-registration is enabled, or instances are internet-facing. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the breadth of affected endpoints and the presence of a public GitHub security advisory make the issue operationally relevant for exposed, multi-tenant deployments.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 lets an authenticated low-privileged attacker read sensitive database information through specific endpoints that fail to validate input. Exploitation requires a valid low-privileged ERPNext session and network reachability to the affected instance; no user interaction or elevated privileges are needed, and patched 15.106.0/16.16.0 versions are not affected. There is no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
Missing authorization checks in Frappe ERPNext allow an authenticated user to create and modify records beyond what their assigned role permits, giving high integrity impact with no confidentiality or availability effect. Exploitation requires a valid ERPNext login with at least low privileges (CVSS PR:L), so fully unauthenticated outsiders cannot abuse it, and only deployments running versions before 15.119.0 or 16.x before 16.31.0 are affected. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, making this a moderate-priority integrity and access-control problem whose realistic risk is concentrated among insiders or anyone holding standard user credentials.
Authenticated low-privileged users in Frappe ERPNext (all versions before 15.119.0, and 16.x before 16.31.0) can read valuation and stock-costing data beyond what their assigned role permits, because specific endpoints fail to enforce authorization checks. Exploitation requires a valid low-privileged account (PR:L per the CVSS 4.0 vector) and network access to the application; the assessed impact is confidentiality-only (CVSS:3.1 C:H/I:N/A:N), so this is primarily an insider or compromised-account risk in multi-user or multi-tenant deployments rather than an unauthenticated intrusion path. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though a vendor security advisory and a third-party (VulnCheck) advisory are available.
Missing authorization checks in project-related endpoints of Frappe ERPNext allow any authenticated low-privilege user (CVSS v3.1 PR:L, remote, no user interaction) to read project data that their assigned role should not permit, resulting in a high-confidentiality, read-only disclosure with no integrity or availability impact. Affected deployments are ERPNext versions before 15.111.0 and 16.x before 16.22.0, with vendor patches available at 15.111.0 and 16.22.0; there is no public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). The practical risk is highest in multi-user or multi-tenant installations where semi-trusted or low-privileged accounts exist, since exploitation only requires a valid account and direct knowledge of the affected endpoint calls.
Authenticated users can modify records in Frappe ERPNext before 16.22.0 by invoking endpoints that omit proper authorization checks, allowing operations beyond their permitted role and resulting in unauthorized data modification. This missing authorization flaw (CWE-862) requires a valid low-privilege account and network access to the ERPNext web application, but no victim interaction; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms integrity impact only. No public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 allows an authenticated attacker holding a low-privilege account to read sensitive information from the backend database by sending crafted requests to specific endpoints that fail to validate input. The assessed impact is confidentiality-only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor CVSS 4.0 base 7.1), meaning data extraction rather than integrity or availability loss, and exploitation is gated by the need for a valid ERPNext session and reachability of the affected endpoints. No public exploit code has been identified at time of analysis and there is no KEV listing, but the low complexity of the attack and the availability of vendor advisories mean patched versions should be applied promptly.
SQL injection in Frappe ERPNext allows authenticated attackers to read sensitive data from the underlying database by sending specially crafted requests to endpoints that fail to validate user-supplied input. The flaw affects ERPNext releases before 15.110.0 and 16.x versions before 16.21.0, and exploitation requires a valid low-privilege session (CVSS PR:L), so it cannot be triggered by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation; the assessed risk is moderate-priority given the authentication barrier and the read-only confidentiality impact (C:H/I:N/A:N).
Missing authorization checks in Frappe ERPNext versions before 16.14.0 allow authenticated users to modify master data records that lie outside their assigned role, giving them write access they were never granted. The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H) confirms the issue is network-reachable but requires at least a low-privileged account; only data integrity is affected, with no confidentiality or availability impact. Per our assessment this is a legitimate but moderate-priority access-control gap rather than a critical emergency, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Upgrading to 16.14.0 removes the condition entirely.
Missing authorization in Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 allows authenticated low-privileged attackers to read financial data beyond their permitted role. The vulnerability is network-reachable with low attack complexity and requires only a valid low-privileged account, resulting in high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score is 7.1 (High).
Stored cross-site scripting in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows unauthenticated visitors to plant crafted HTML/script through a public-facing booking page; the payload is stored without neutralization and executes in the browser session of a privileged user who later views the booking content, enabling account takeover of that user. Exploitation is conditional: the instance must expose the public booking feature to untrusted submitters, and impact only completes when an authenticated, higher-privileged user opens the tainted content (UI:P in the CVSS 4.0 vector), so the attack is not fully automatable to immediate compromise and no public exploit code was identified at time of analysis. The vendor has released fixed versions, and this is a genuine priority for organizations that run the vulnerable booking workflow, not merely a high-score-on-paper issue.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 allow authenticated users with low privileges to call certain endpoints directly and read data beyond what their assigned role permits. The flaw is confidentiality-only (CWE-862, missing authorization): the CVSS v4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:N/VA:N) and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 7.1) agree that no data modification or denial of service is possible and that network access plus a valid low-privilege ERPNext account is required, with no user interaction. There is no public exploit identified at time of analysis, though the realistic threat population is insiders, compromised credentials, or environments that issue low-trust/portal logins, so the practical risk is moderate-priority exposure of sensitive ERP records rather than unauthenticated compromise.
SQL injection in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows an authenticated user with only low privileges to read sensitive data out of the underlying database by sending crafted input to endpoints that do not validate parameters before building SQL queries. Unauthenticated and anonymous users cannot trigger the flaw - a valid ERPNext session is required (PR:L), and the impact is limited to confidentiality (high data disclosure, no integrity or availability loss), which caps the practical severity despite the 7.1 CVSS v4.0 base score. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence; the principal exposure is any production instance running an affected version with normal user accounts.
Missing authorization checks in Frappe ERPNext allow an authenticated low-privileged user to invoke status-modification endpoints that omit proper role enforcement, altering record status and business data beyond the attacker's assigned role. Affected versions are ERPNext before 15.121.0 and 16.x before 16.34.0; exploitation requires a valid ERPNext account with at least low privileges (CVSS PR:L) and is reachable over the network, but carries no confidentiality or availability impact, making it primarily an integrity-focused insider or post-account-compromise escalation path. No public exploit code has been identified and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not available in the provided intelligence. Vendor-released fixes are available in 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 allow an authenticated user holding only a low-privileged role to bypass role-based access control and read financial data by issuing direct requests to specific endpoints. The affected vector is network-reachable with low complexity but requires a valid account (PR:L), and the impact is limited to read-only confidentiality loss - no data modification or denial of service is possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so it is a moderate-priority broken access control flaw rather than an emergency; patched instances and deployments restricted to trusted users carry substantially reduced practical risk.
Authenticated SQL injection in Frappe ERPNext before 16.34.2 allows users holding only low-privilege accounts to send crafted requests to multiple application endpoints and read sensitive data out of the underlying database. The flaw is a missing input validation issue (CWE-89) that is remotely reachable without user interaction, but it is gated behind the need for valid low-privilege credentials, which limits it to a moderate, authentication-dependent risk rather than an anonymous internet-wide exposure; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing role-based authorization enforcement in Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 lets any authenticated user read financial data that their assigned role should not permit. Because the vulnerable endpoints can be requested directly over the network with any valid low-privilege account and require no user interaction or non-default configuration, the practical risk is malicious insiders or attackers operating with stolen, shared, or weak credentials rather than anonymous outsiders. Impact is confidentiality-only (no data modification or availability loss), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released fixed versions 15.121.3 and 16.35.0.
Missing authorization enforcement in Frappe ERPNext endpoints lets authenticated low-privileged users read personal data beyond the scope their assigned role permits, affecting releases before 15.120.0 and 16.x before 16.33.0. The flaw is network-reachable and requires only a valid session for a minimal role, as reflected in the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N with confidentiality-only impact (C:H, I:N, A:N) and a CVSS 4.0 base score of 7.1; unauthenticated attackers cannot exploit it. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a moderate-priority access-control defect rather than a critical remote-code compromise, with the main risk being unauthorized disclosure of employee, customer, or contact records held in the ERP.
Frappe ERPNext instances running releases before 15.120.0, or 16.x releases before 16.23.0, contain an authorization bypass that allows any authenticated user - including a low-privilege account - to read party records outside the scope of their assigned role. The affected endpoint honours a caller-supplied flag that is meant to disable its own permission enforcement, so simply setting that flag in the request causes the server to skip the role check entirely; the result is a read-only confidentiality exposure with no write, modification, or availability impact. No public exploit code has been identified at time of analysis, but exploitation requires only a valid session and is most consequential on multi-user or multi-tenant deployments where party data is meant to be segregated by role, making this a legitimate but moderate-priority issue rather than a top-tier emergency.
Authenticated low-privileged users can create documents beyond their permitted roles in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0, because certain document-creation endpoints omit the role-based authorization checks the Frappe permission model normally enforces. The flaw is a CWE-862 missing authorization issue scored CVSS 4.0 7.1 (an independent CVSS 3.1 assessment also returns 7.1), with high integrity impact and low confidentiality impact, requiring only a valid low-privilege account (PR:L) and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, but deployments that permit self-registration or issue portal/customer accounts widen the realistic attacker pool.
Missing authorization checks in Frappe ERPNext before 15.121.3 and in 16.x before 16.35.0 allow any authenticated user - including a low-privilege or self-registered account - to send requests to certain endpoints and modify data beyond what their assigned role permits. Authentication is mandatory (PR:L in the assessed vector), so anonymous remote exploitation is not possible; risk is concentrated in deployments with many distinct user roles, untrusted or self-registered users, or exposure to credential compromise. There is no public exploit identified at time of analysis and no CISA KEV entry, and the vendor has released fixed versions in the 15.x and 16.x lines.
Missing authorization in Frappe ERPNext document-creation endpoints (all versions before 15.121.0, and 16.x before 16.34.0) lets any authenticated low-privileged user - a portal, employee, or customer self-service account - create documents against records beyond their permitted role, bypassing role-based access controls. Impact is confined to integrity: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) and our independent CVSS 3.1 assessment of 7.1 (I:H, C:N, A:N) both show unauthorized document creation with no data disclosure or service disruption. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, while vendor-released fixes exist in ERPNext 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 16.34.0 allow any authenticated user to read financial records - accounting, ledger and invoice data - that their assigned role should not permit, resulting in a confidentiality-only breach. Exploitation requires only a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 7.1) and network reachability to the instance; no admin rights, user interaction, or special configuration are needed, which scopes the practical risk toward insiders or attackers holding stolen or self-registered low-trust accounts. No public exploit code has been identified at time of analysis, and CVE-2026-109614 is not confirmed actively exploited (CISA KEV); it is assessed as a credible but moderate-priority issue rather than a critical emergency.
Missing authorization checks in Frappe ERPNext document-status modification endpoints allow authenticated low-privileged users to alter records beyond their assigned roles, with the primary impact being high integrity loss and limited availability impact (CVSS 4.0 7.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:L). Only instances running the 15.x branch below 15.121.0 or the 16.x branch below 16.34.0 are affected, and exploitation requires a valid low-privilege account plus reachability and knowledge of the relevant status endpoints - no administrative access or anonymous path exists, and confidentiality is unaffected. This is a genuine but moderate-priority issue rather than a critical emergency; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
Stored cross-site scripting in Frappe ERPNext allows any authenticated user with permission to create records to plant a crafted record name that is later rendered unescaped in a report view, executing arbitrary script in the browser session of whichever user opens that report. Exploitation is not remote-unauthenticated: it requires valid credentials plus create-record rights (CVSS 4.0 PR:L) and is further gated on a second user subsequently opening the vulnerable report (UI:P), meaning the payload lies dormant until then. Impact spans the confidentiality and integrity of the affected session and can be severe when a high-privileged administrator views the report; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the issue is rated 8.5 and warrants prompt patching.
Authenticated low-privileged users can modify documents and data beyond their assigned role permissions in Frappe ERPNext before 15.119.1 and in 16.x before 16.32.0, because certain endpoints fail to enforce proper permission checks (CWE-862, Missing Authorization). The issue is rated CVSS 4.0 7.1 (CVSS:3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - integrity-only impact with no confidentiality or availability effect - and exploitation requires a valid ERPNext session for a low-privileged account plus knowledge of the specific unguarded endpoints, so it is not reachable by anonymous or unauthenticated attackers. There is no CISA KEV listing and no public exploit identified at time of analysis; realistic risk is confined to malicious insiders or attackers who already hold low-privilege credentials, and vendor-released fixes are available in 15.119.1 and 16.32.0.
SQL injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 allows authenticated attackers with low privileges to extract sensitive information from the database via crafted requests to endpoints lacking input validation. The vulnerability is not known to be actively exploited, and no public exploit code has been identified at time of analysis. With a CVSS 4.0 score of 7.1, exploitation requires network access and valid low-privilege credentials, making it a significant risk for insiders or compromised accounts in multi-tenant deployments.
SQL injection in Frappe ERPNext 15.x before 15.121.0 and 16.x before 16.34.0 lets any authenticated user, including an account with no assigned roles, inject crafted parameters into several endpoints that lack input validation, read other users' sensitive information, and escalate to a privileged account. Because only the lowest privilege level is needed (CVSS 4.0 PR:L; independently assessed at 8.7 under a 3.1 vector of AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact), deployments that permit self-registration or hand out broad low-privilege accounts face a nearly trivial authentication barrier, while tightly controlled instances still require a valid login. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory is public, so unpatched, internet-reachable instances should be treated as high priority.
Stored cross-site scripting in Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 allows an authenticated user who can create the affected record type to embed script in a record name, which is then interpolated unescaped into markup by a tool view and executed in the browser session of any user who later opens that tool. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that exploitation is authentication-gated at low privileges and depends on victim interaction, making this a moderate-priority, insider-reachable issue rather than an unauthenticated emergency; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because the payload persists in stored data, a single malicious record name can affect every user who subsequently visits the vulnerable tool view, so scope is limited to session-level script execution in the victim's context rather than direct server compromise.
SQL injection in ERPNext's Inactive Customers report allows any authenticated user to manipulate raw database queries via an unvalidated doctype filter parameter. Affected versions prior to 15.116.0 (v15 branch) and 16.23.0 (v16 branch) interpolate user-supplied input directly into f-string SQL in get_sales_details and get_last_sales_amt, enabling exfiltration of sensitive ERP data and limited database manipulation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Server-side template injection in ERPNext (Frappe framework) lets low-privileged authenticated users escape the Frappe safe-execution sandbox and achieve remote code execution on the server. The root cause is that frappe.render_template was exposed inside the safe_exec globals without forcing restrict_globals, so a user who can supply template content crosses a permission boundary into unrestricted Jinja evaluation. Rated CVSS 9.9 with a scope change; no public exploit code or CISA KEV listing is identified at time of analysis, but the fix commit is public, narrowing the reversing effort required.
Improper authorization in ERPNext's CRM module allows authenticated low-privileged users to retrieve CRM opportunity data beyond their permitted scope via the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. Versions before 15.115.0 and before 16.26.0 are affected, with patches now available from Frappe. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-privilege, network-accessible nature of the flaw makes it a realistic insider threat or credential-abuse vector.
Server-side template injection in Frappe ERPNext (versions before 15.111.0 and 16.22.0) lets an authenticated user holding only a standard operational role inject a malicious template payload into a configuration field, causing the server to render it and disclose data the user is not authorized to see. Because the flaw is rooted in an authorization failure (CWE-863), it effectively bypasses ERPNext's role/permission boundaries. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a fixed release is available from the vendor.
SQL injection in ERPNext versions prior to 16.9.0 allows authenticated remote attackers to extract sensitive data by sending specially crafted requests to vulnerable endpoints. The Frappe-maintained ERP platform requires low-privileged authentication (PR:L) but has high impact on confidentiality, integrity, and availability per CVSS 8.8. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%).
SQL injection in ERPNext (Frappe's open-source ERP platform) prior to 15.104.3 and 16.14.0 allows authenticated remote attackers to extract sensitive database contents by sending crafted requests to vulnerable endpoints. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though EPSS sits at 0.04% and SSVC reports no observed exploitation, indicating this is a high-severity but currently unexploited issue. No public exploit identified at time of analysis.
Privilege escalation in ERPNext versions prior to 16.9.1 allows authenticated low-privileged users to modify data outside their assigned role due to missing authorization checks on certain endpoints. The flaw carries a CVSS 9.9 score with scope change, but EPSS is only 0.04% and CISA SSVC reports no observed exploitation, indicating no public exploit identified at time of analysis. The vendor (Frappe) has released a patched version 16.9.1 alongside GHSA-cg5w-7g26-p3w9.
A blind SQL injection vulnerability exists in ERPNext, a free and open-source Enterprise Resource Planning system, affecting versions prior to 15.100.0 and beta versions 16.0.0-beta.1 through 16.7.x. The vulnerability allows authenticated attackers with low-level privileges to perform time-based and boolean-based blind SQL injection attacks through insufficiently validated parameters on certain endpoints, enabling them to infer and extract sensitive database information. This is tagged as an SQLi vulnerability and has been assigned EUVD-2026-13547 by ENISA, with patches available in versions 15.100.0 and 16.8.0.
Missing authorization in ERPNext ERP before 15.98.0/16.6.0. Patch available.
ERPNext instances prior to 15.118.0 (v15 branch) and 16.27.0 (v16 branch) expose financial data through the Sales Person-wise Transaction Summary report because the report's server-side query omits the requesting user's document-permission match conditions. An authenticated attacker holding only a limited role that can run this report can read Sales Order/Sales Invoice, Sales Team, and item-level financial rows for records the role should never see, resulting in a high-confidentiality, read-only disclosure (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; CWE-862 Missing Authorization). No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, so risk is driven by the low exploitation complexity for any logged-in low-privilege user rather than by observed attacks.
Stored cross-site scripting in Frappe ERPNext (15.x before 15.110.0 and 16.x before 16.21.0) lets an authenticated user who holds write access to item master data persist JavaScript inside a record name, which is then rendered without escaping and executes in the browser of any operator who opens the affected item page. Exploitation requires an existing account with item-write privileges plus a second user later viewing the poisoned record, so it is an insider- or compromised-account scenario rather than a remote unauthenticated attack, and the impact is confined to the viewing operator's browser session rather than the ERPNext server. Severity is moderate (CVSS 4.0 base 5.1; independent assessment 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), no public exploit code and no confirmed active exploitation were identified at time of analysis, and upgrading to 15.110.0 or 16.21.0 removes the condition.
Missing authorization checks in Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 let an authenticated low-privileged user change the status of records they should not be able to touch, bypassing role-based access restrictions. The flaw carries a vendor/VulnCheck CVSS 4.0 base score of 5.3 (moderate) and requires a valid low-privileged session, so exploitation is limited to insiders or holders of legitimately provisioned low-tier accounts; impact is integrity-only, with no confidentiality or availability effect. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited (no CISA KEV listing); vendor patches are available in 15.110.0 and 16.21.0, so the practical priority is moderate - patch on a normal maintenance cadence.
Missing authorization checks in Frappe ERPNext party-record endpoints let any authenticated user with a low-privileged role modify party records beyond what their role permits. Affected deployments are ERPNext versions before 15.110.0 and 16.x releases before 16.21.0; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.3) confirms the attack requires a valid low-privileged account and results in limited integrity impact only, with no confidentiality or availability effect. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium/low-priority hardening issue rather than an urgent one, and instances already on 15.110.0 or 16.21.0+ are unaffected.
Authenticated users holding only low-privilege roles in Frappe ERPNext can call specific endpoints that fail to enforce role-based permission checks, allowing them to deactivate master records outside their assigned permissions. The flaw affects ERPNext releases before 15.108.0 and 16.x before 16.18.0 and carries a moderate 5.3 severity, with impact confined to the integrity of master data - the assessed vector shows no confidentiality loss, no availability impact, and no scope change. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (not listed in CISA KEV).
Authenticated users in Frappe ERPNext deployments before 15.112.0 can bypass role-based record permissions by calling specific endpoints that lack proper authorization validation, allowing them to modify individual fields on record types they are not permitted to edit. This is a medium-severity (CVSS 5.3) broken-access-control flaw (CWE-862) with integrity-only impact and no confidentiality or availability loss; no public exploit identified at time of analysis. A vendor security advisory (GHSA-f7x9-qfrf-92m8) and VulnCheck advisory provide further details.
Stored cross-site scripting in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) lets unauthenticated attackers inject crafted markup through a publicly exposed portal form that saves submissions for later back-office review; the payload executes in the browser of the authenticated staff member who opens the stored record. Because the CVSS 4.0 vector carries PR:N, the entry point is unauthenticated, but exploitation is not self-triggering - a human review action is a hard prerequisite (UI:P), and impact is confined to the reviewing user's browser session (SC:L/SI:L) with no direct server-side confidentiality, integrity, or availability loss (VC:N/VI:N/VA:N). Rated 5.3 (medium), with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); vendor-released patches exist in ERPNext 15.112.0 and 16.23.0.
Stored cross-site scripting in Frappe ERPNext 16.x before 16.27.0 allows an authenticated user who holds edit (write) rights on a document type to set a record's name field to a script payload that the application later renders without HTML escaping. The script executes in the browser of any colleague who subsequently opens the affected record page, enabling session-context actions such as data theft or UI manipulation within that victim's ERPNext session. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 16.27.0, so this is a genuine but limited medium-severity issue rather than an urgent emergency.
Authenticated low-privileged users can cause ERPNext to send transactional emails for documents they are not permitted to read, due to missing authorization checks in certain endpoints. This affects ERPNext before 15.119.0 and 16.x before 16.31.0. The vulnerability is not known to be actively exploited, no public exploit code has been identified, and the CVSS 3.1 base score is 5.3 (moderate), with limited confidentiality and integrity impact.
Server-side request forgery in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) allows an authenticated user holding a common operational role to point a writable configuration field at an arbitrary destination, causing the ERPNext server to issue outbound requests to hosts that are only reachable from inside the deployment's network. The issue is rated CVSS 5.3 and requires a valid session with permissions to edit the affected field (PR:L), so it is not exploitable by fully unauthenticated attackers; real-world impact depends entirely on what internal services - such as cloud metadata endpoints, internal APIs, or databases - are reachable from the application server. No public exploit code has been identified and the flaw is not confirmed as actively exploited (no CISA KEV listing); per our assessment this is a moderate, not urgent, priority that is fully resolved by upgrading to a fixed release.
Missing authorization checks in certain Frappe ERPNext endpoints allow any authenticated user to read records beyond the scope their assigned role should permit, exposing data that role-based access control is intended to restrict. The flaw affects ERPNext versions before 15.110.0 and 16.x before 16.21.0 and is exploitable only by a logged-in user holding at least a low-privilege account (CVSS PR:L, assessed CVSS 3.1 base 5.3); it is not reachable by unauthenticated attackers, and impact is limited to confidentiality since no integrity or availability effects were identified. Vendor patches are available in 15.110.0 and 16.21.0, and no public exploit identified at time of analysis.
Unauthenticated remote attackers can invoke specific Frappe ERPNext endpoints that fail to enforce authorization checks, allowing them to create records and enumerate availability even when an administrator has disabled the corresponding feature. The flaw affects ERPNext before 15.110.0 and 16.x before 16.21.0, is classified as CWE-862 (missing authorization), and carries a moderate risk profile (6.9 CVSS v4.0; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) with impact bounded to low-integrity and low-availability effects and no data disclosure, code execution, or privilege escalation. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation is nonetheless trivial for any network-reachable instance because no authentication, user interaction, or special conditions are required.
Missing authorization in Frappe ERPNext versions before 15.105.0 and 16.x before 16.15.0 allows an authenticated low-privilege portal user to create documents on behalf of other parties, compromising data integrity. The flaw affects document-creation endpoints that fail to verify the requesting portal user belongs to the target party. No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate access-control issue requiring a valid portal account.
SQL injection in Frappe ERPNext (before 15.121.0 and 16.x before 16.34.0) allows an authenticated user holding high privileges to send specially crafted requests to endpoints that lack input validation, injecting SQL that lets them read sensitive information from the underlying database. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, only confidentiality is affected - data can be read but not modified or destroyed - and the attacker must already hold an elevated/administrative account, which confines realistic risk to insiders or environments where a privileged account has been compromised. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency; vendor patches exist in 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 15.121.0 and in 16.x before 16.34.0 let an authenticated user call certain endpoints that do not enforce role-based permission rules, exposing records the account's role should not be able to read. Exploitation requires valid credentials or an active session as a lower-privileged user (PR:L per the CVSS vector), and the impact is confined to unauthorized data disclosure - no modification, deletion, or code execution is possible through this flaw. Independent assessment rates it medium severity (CVSS 3.1 5.3), and no public exploit code has been identified at time of analysis; the practical risk scales with how many low-trust or untrusted authenticated accounts exist in a given deployment and how sensitive the role-restricted data is.
Authenticated users of Frappe ERPNext (before 15.121.3 and 16.x before 16.35.0) can abuse a transactional-email endpoint to send arbitrary messages through the site's own configured outgoing mail account, because the endpoint does not verify the caller's authorization before dispatching mail. Any low-privilege account is sufficient - no admin role or special permission is required - and the site must simply have an outgoing email account configured, which is the default for a functioning ERPNext deployment. The result is email relay abuse under the organisation's trusted sending identity, useful for phishing, spam, or reputational damage rather than data theft or service disruption; the assessed impact is limited to low integrity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Missing authorization enforcement in certain Frappe ERPNext endpoints allows an authenticated user holding only low-privilege role access to modify documents and records beyond the permissions assigned to their role, affecting all releases before 15.121.1 and 16.x before 16.34.2. Exploitation requires valid ERPNext credentials and the ability to reach the affected endpoints, but no user interaction and no non-default configuration - the flaw lies in the endpoints' own failure to check roles (CWE-862). Impact is bounded to low confidentiality and low integrity effects with no availability impact, no public exploit code has been identified at time of analysis, and the vendor has released patched versions (see advisory GHSA-49wp-r82c-j825).
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 allow authenticated users to modify data beyond their permitted role, compromising data integrity with no confidentiality or availability impact. Exploitation requires a valid low-privilege ERPNext account (PR:L) and reachable endpoints that fail to enforce role-based authorization; anonymous access is not possible, and no public exploit identified at time of analysis. This is a moderate-severity broken access control issue, not a critical flaw.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 let authenticated users with low-privilege roles modify data beyond their assigned permissions through certain network-reachable endpoints. According to the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), exploitation requires a valid authenticated session and results only in limited integrity impact, with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the vendor has released fixed versions 15.121.0 and 16.34.0.
Reflected cross-site scripting in Frappe ERPNext (all versions before 14.92.1, and 15.x before 15.83.0) lets an attacker inject arbitrary JavaScript that runs inside an authenticated user's session, enabling session/account takeover. The attacker needs no credentials (PR:N in the CVSS vectors), but exploitation requires a logged-in victim to follow a crafted URL (UI:P), so it is delivered by phishing or social engineering rather than by a direct server-side attack. Impact is rated high for confidentiality and integrity (VC:H/VI:H) with scope change under the CVSS 4.0 vector (8.6) and CVSS 3.1 equivalent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N); there is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is lower priority than a zero-interaction network RCE.
pacioli-guard 0.9.6 fails to check that a consent marker actually authorizes a cancellation, so a nested Document.cancel() call can ride a valid human-minted submit marker belonging to an enclosing governed act and reverse the ledger effect of a different, caller-named pre-existing submitted document such as a Sales Invoice. The flaw is an incorrect-authorization defect (CWE-863) that bypasses the marker's document binding, act binding, single-use spend accounting, and denial audit, and it is reachable by an authenticated API-key credential holding Scope.require_consent (PR:L) only after a legitimate human has minted the enclosing submit marker (UI:R), which is why it rates a medium CVSS 5.7. Principals without a consent-gated grant are explicitly unaffected, and no public exploit has been identified at time of analysis - there is no CISA KEV listing for this CVE.
Authenticated users holding the ERPNext Accounts Manager role can invoke arbitrary non-whitelisted server-side Python methods and read back their return values in Frappe ERPNext versions before 16.34.1. The flaw lives in Financial Report Template handling: a Custom API row's calculation_formula is passed straight to frappe.call() without verifying that the dotted path resolves to a whitelisted, GET-permitting method, so an attacker with rights to create or edit such templates can point the formula at internal methods that were never meant to be remotely callable. The assessed impact is limited information disclosure and limited integrity impact (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; CVSS 4.0 5.3), exploitation requires a privileged non-default role, no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data indicates active exploitation. This is a genuine but modest-severity issue best treated as medium-low priority.
SQL injection in ERPNext's tax rule engine allows any authenticated low-privilege user to extract arbitrary database content. The get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py directly interpolated request-supplied posting_date and args dictionary values into raw SQL WHERE clauses via Python f-strings and .format() calls, bypassing all parameterization. Vendor-released patches exist as versions 15.109.0 and 16.20.0; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization in ERPNext's account creation function allows any authenticated low-privilege user to bypass the Account doctype's create permission gate and insert unauthorized chart-of-accounts entries, directly corrupting financial data integrity and audit trails. All ERPNext releases prior to v15.111.0 (v15 branch) and v16.22.0 (v16 branch) are affected, as confirmed by vendor security advisory GHSA-94v6-784v-24q5 and the published PR diff. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in ERPNext's Process Statement of Accounts module allows any authenticated low-privilege user to invoke the send_emails function and dispatch automated account statement emails to customers without holding the required role. Versions prior to 15.111.0 (v15 branch) and 16.22.0 (v16 branch) are affected across all ERPNext deployments using this accounts feature. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the vendor has released confirmed patches for both active version branches.
Stored cross-site scripting in ERPNext 16.16.0 allows an authenticated user holding Item record edit permissions to persist malicious HTML/JavaScript in the item_name, description, or image fields, which executes unescaped in the Point of Sale (POS) cart interface for any operator who subsequently adds that item to a transaction. Reported by Fluid Attacks (EUVD-2026-34158), this is a stored XSS with lateral impact across all POS operator sessions exposed to the poisoned item record. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 4.8 reflects the constrained attack surface imposed by high privilege prerequisites and required passive user interaction.
Stored cross-site scripting in ERPNext 16.16.0 allows authenticated users to inject arbitrary HTML and JavaScript into the email_id or mobile_no fields of Customer records, which execute silently in the browser of every Point of Sale (POS) operator who subsequently selects the poisoned customer. Because the payload persists in the database, a single injection event affects all future POS operator sessions that encounter that customer - creating a multiplier effect without requiring repeated attacker access. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided in available intelligence sources.
Insufficient authorization enforcement on specific ERPNext endpoints allows authenticated low-privilege users to read sensitive data beyond their permitted role and make limited unauthorized data modifications. Affecting all ERPNext deployments prior to 15.102.0 (v15 branch) and prior to 16.11.0 (v16 branch), an attacker holding any valid user account can invoke unprotected server-side endpoints to access restricted records or alter data outside their role scope. No public exploit code exists and SSVC confirms no active exploitation, but the high confidentiality impact (CVSS C:H) warrants prompt patching - particularly on internet-exposed ERPNext instances where low-privilege accounts may be broadly distributed.
XML External Entity (XXE) injection in ERPNext's EDI Module allows authenticated low-privilege attackers to read arbitrary files from the server's local filesystem, including sensitive configuration files that may contain database credentials or API keys. Affected are all ERPNext installations on the v15 branch prior to 15.104.3 and on the v16 branch prior to 16.12.0 (cpe:2.3:a:frappe:erpnext:*). No public exploit identified at time of analysis, EPSS exploitation probability sits at 0.06% (18th percentile), and CISA SSVC assesses exploitation as none and the attack as non-automatable - collectively placing this at lower operational priority despite its network-accessible attack vector.
Server-Side Request Forgery (SSRF) in ERPNext allows an authenticated remote attacker to send a crafted request to a vulnerable endpoint, causing the ERPNext server to issue arbitrary outbound HTTP calls to attacker-controlled services. The CVSS Changed scope (S:C) indicates the impact extends beyond the application itself, enabling potential access to internal network resources, cloud metadata services, or other intranet endpoints not otherwise reachable by the attacker. Vendor-released patches exist in versions 15.106.0 and 16.16.0; no active exploitation has been confirmed (not listed in CISA KEV) and EPSS sits at a very low 0.02%.
Path traversal in ERPNext exposes arbitrary server files to authenticated low-privileged users via a vulnerable endpoint that fails to restrict directory access. Affected versions are ERPNext prior to 15.101.1 and the 16.x beta line prior to 16.10.0, packaged under CPE cpe:2.3:a:frappe:erpnext. An attacker with a valid account can craft a request to read sensitive files outside the intended directory scope, resulting in full confidentiality compromise of the host filesystem. No public exploit identified at time of analysis, and CISA SSVC signals no active exploitation.
Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. [CVSS 4.1 MEDIUM]