Erpnext
Monthly
A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. [CVSS 5.4 MEDIUM]
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on it) lets attackers upload a crafted XML/SVG file through the Attachments module that runs attacker-controlled script when a victim views it. Tagged as XSS/RCE/File Upload with a publicly available exploit code, though EPSS remains low at 0.44% (35th percentile) and it is not on CISA KEV. The CVSS 9.6 rating reflects a scope-changing, user-interaction-dependent attack rather than direct server-side compromise.
Authenticated SQL injection in Frappe ERPNext through 15.89.0 allows low-privilege users to extract arbitrary database contents via the to_posting_date parameter in get_outstanding_reference_documents(). Publicly available exploit code exists, though no active exploitation is confirmed (CISA KEV not indicated). The flaw requires authentication (PR:L) but no special configuration, making it a significant risk for multi-tenant or internet-facing deployments where low-privilege accounts are common.
SQL injection in Frappe ERPNext through 15.89.0 lets an authenticated attacker with a valid session and access to the Payment Entry/Accounts outstanding-reference lookup extract arbitrary database data by supplying a crafted from_posting_date value to get_outstanding_reference_documents(). Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. Independent assessment rates the confidentiality impact as high with low integrity and no availability impact, making this a genuine actionable priority despite the public proof of concept.
Authenticated attackers with permission to create or modify Print Format documents in Frappe ERPNext through 15.89.0 can exploit a Server-Side Template Injection flaw to read sensitive database information. The vulnerability arises because the Print Format rendering path exposes frappe.db.sql inside a Jinja2 SandboxedEnvironment, allowing crafted template expressions to query the backend database. Publicly available exploit code exists, and the CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though exploitation requires a privileged customization role and no active exploitation in CISA KEV has been confirmed.
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 lets a user who can create or modify an Address Template inject arbitrary Jinja expressions that get_address_display later renders, yielding server-side code execution or database information disclosure. The root cause is that ERPNext's custom Jinja2 SandboxedEnvironment still exposes dangerous callables such as frappe.db.sql through get_safe_globals(), and the issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, and although exploitation requires an authenticated account holding the administrative-level Address Template write permission plus the ability to create an Address document with a matching country and call get_address_display with address_dict set to that document's name, the resulting impact on confidentiality, integrity, and availability is high.
Server-side template injection (SSTI) in Frappe ERPNext through 15.89.0 allows authenticated users who can create or modify Terms and Conditions documents to execute restricted Jinja2 expressions and leak sensitive database information. Publicly available exploit code exists, and the vulnerability is assessed to have high confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) without affecting integrity or availability. Exploitation requires only the inherent document-write privilege, and no non-default server configuration is needed, though the sandboxed environment limits the outcome to database disclosure rather than arbitrary code execution.
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 allows any user with create or modify permission on the Contract Template doctype to place arbitrary Jinja2 expressions into the contract_terms field, which the get_contract_template method later passes to frappe.render_template(). Because Frappe's get_safe_globals() still exposes dangerous callables such as frappe.db.sql despite the custom SandboxedEnvironment, an attacker can read arbitrary database contents, though no integrity or availability impact has been demonstrated. Publicly available exploit code exists (no CISA KEV listing), and exploitation is gated by the Contract Template privilege requirement, so this is best treated as a medium-severity, authenticated information-disclosure issue rather than a top-priority emergency.
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 allows users with privileges to configure Dunning Type and its Dunning Letter Text child table to inject arbitrary Jinja2 expressions via the get_dunning_letter_text method's body_text field, leading to database information disclosure through exposed globals like frappe.db.sql. Publicly available exploit code exists, though the custom SandboxedEnvironment limits full remote code execution. Exploitation requires a valid authenticated session and the specific Dunning configuration privilege, not a default low-privilege or anonymous role.
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field.
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter.
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventory_dimensions_dict parameter.
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanket_order_type parameter.
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter.
In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, which allows an. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL injection, which allows an attacker to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ERP is a free and open source Enterprise Resource Planning tool. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available.
In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available.
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. [CVSS 5.4 MEDIUM]
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on it) lets attackers upload a crafted XML/SVG file through the Attachments module that runs attacker-controlled script when a victim views it. Tagged as XSS/RCE/File Upload with a publicly available exploit code, though EPSS remains low at 0.44% (35th percentile) and it is not on CISA KEV. The CVSS 9.6 rating reflects a scope-changing, user-interaction-dependent attack rather than direct server-side compromise.
Authenticated SQL injection in Frappe ERPNext through 15.89.0 allows low-privilege users to extract arbitrary database contents via the to_posting_date parameter in get_outstanding_reference_documents(). Publicly available exploit code exists, though no active exploitation is confirmed (CISA KEV not indicated). The flaw requires authentication (PR:L) but no special configuration, making it a significant risk for multi-tenant or internet-facing deployments where low-privilege accounts are common.
SQL injection in Frappe ERPNext through 15.89.0 lets an authenticated attacker with a valid session and access to the Payment Entry/Accounts outstanding-reference lookup extract arbitrary database data by supplying a crafted from_posting_date value to get_outstanding_reference_documents(). Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. Independent assessment rates the confidentiality impact as high with low integrity and no availability impact, making this a genuine actionable priority despite the public proof of concept.
Authenticated attackers with permission to create or modify Print Format documents in Frappe ERPNext through 15.89.0 can exploit a Server-Side Template Injection flaw to read sensitive database information. The vulnerability arises because the Print Format rendering path exposes frappe.db.sql inside a Jinja2 SandboxedEnvironment, allowing crafted template expressions to query the backend database. Publicly available exploit code exists, and the CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though exploitation requires a privileged customization role and no active exploitation in CISA KEV has been confirmed.
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 lets a user who can create or modify an Address Template inject arbitrary Jinja expressions that get_address_display later renders, yielding server-side code execution or database information disclosure. The root cause is that ERPNext's custom Jinja2 SandboxedEnvironment still exposes dangerous callables such as frappe.db.sql through get_safe_globals(), and the issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, and although exploitation requires an authenticated account holding the administrative-level Address Template write permission plus the ability to create an Address document with a matching country and call get_address_display with address_dict set to that document's name, the resulting impact on confidentiality, integrity, and availability is high.
Server-side template injection (SSTI) in Frappe ERPNext through 15.89.0 allows authenticated users who can create or modify Terms and Conditions documents to execute restricted Jinja2 expressions and leak sensitive database information. Publicly available exploit code exists, and the vulnerability is assessed to have high confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) without affecting integrity or availability. Exploitation requires only the inherent document-write privilege, and no non-default server configuration is needed, though the sandboxed environment limits the outcome to database disclosure rather than arbitrary code execution.
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 allows any user with create or modify permission on the Contract Template doctype to place arbitrary Jinja2 expressions into the contract_terms field, which the get_contract_template method later passes to frappe.render_template(). Because Frappe's get_safe_globals() still exposes dangerous callables such as frappe.db.sql despite the custom SandboxedEnvironment, an attacker can read arbitrary database contents, though no integrity or availability impact has been demonstrated. Publicly available exploit code exists (no CISA KEV listing), and exploitation is gated by the Contract Template privilege requirement, so this is best treated as a medium-severity, authenticated information-disclosure issue rather than a top-priority emergency.
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 allows users with privileges to configure Dunning Type and its Dunning Letter Text child table to inject arbitrary Jinja2 expressions via the get_dunning_letter_text method's body_text field, leading to database information disclosure through exposed globals like frappe.db.sql. Publicly available exploit code exists, though the custom SandboxedEnvironment limits full remote code execution. Exploitation requires a valid authenticated session and the specific Dunning configuration privilege, not a default low-privilege or anonymous role.
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field.
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter.
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventory_dimensions_dict parameter.
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanket_order_type parameter.
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter.
In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, which allows an. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL injection, which allows an attacker to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ERP is a free and open source Enterprise Resource Planning tool. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available.
In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available.
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.