# cve.now: Frappe

The newest entries naming Frappe as an affected vendor (up to 200), of 266 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-124443](https://cve.now/CVE-2026-124443.md): Frappe before 16.35.0 Broken Access Control in File List/Report Queries (CVSS 5.3)
- [CVE-2026-124316](https://cve.now/CVE-2026-124316.md): Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get\_linked\_material\_requests (CVSS 5.3)
- [CVE-2026-124315](https://cve.now/CVE-2026-124315.md): Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get\_bom\_items (CVSS 7.1)
- [CVE-2026-124314](https://cve.now/CVE-2026-124314.md): Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get\_open\_activities (CVSS 7.1)
- [CVE-2026-124313](https://cve.now/CVE-2026-124313.md): Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get\_linked\_payments\_for\_doc (CVSS 5.3)
- [CVE-2026-121442](https://cve.now/CVE-2026-121442.md): Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API (CVSS 5.3)
- [CVE-2026-61806](https://cve.now/CVE-2026-61806.md): Frappe LMS allows unpublished certificate access (CVSS 5.3)
- [CVE-2026-61805](https://cve.now/CVE-2026-61805.md): Frappe LMS: Quiz result manipulation and cross-user submission forgery (CVSS 5.3)
- [CVE-2026-61803](https://cve.now/CVE-2026-61803.md): Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount (CVSS 5.3)
- [CVE-2026-39375](https://cve.now/CVE-2026-39375.md): Frappe LMS has Stored XSS in Course Meta (CVSS 5.1)
- [CVE-2026-119145](https://cve.now/CVE-2026-119145.md): Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload (CVSS 9.4)
- [CVE-2026-119144](https://cve.now/CVE-2026-119144.md): Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields (CVSS 8.7)
- [CVE-2026-116492](https://cve.now/CVE-2026-116492.md): Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API (CVSS 7.1)
- [CVE-2026-115720](https://cve.now/CVE-2026-115720.md): Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect (CVSS 5.3)
- [CVE-2026-115717](https://cve.now/CVE-2026-115717.md): Frappe Builder before 1.36.1 SSRF via convert\_to\_webp (CVSS 6.3)
- [CVE-2026-115718](https://cve.now/CVE-2026-115718.md): Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve\_prompt (CVSS 5.3)
- [CVE-2026-114664](https://cve.now/CVE-2026-114664.md): Frappe before 16.33.0 Blind SQL Injection via get\_events (CVSS 7.1)
- [CVE-2026-111939](https://cve.now/CVE-2026-111939.md): Frappe Helpdesk before 1.26.0 Authorization Bypass via raised\_by in Ticket Creation (CVSS 5.1)
- [CVE-2026-111938](https://cve.now/CVE-2026-111938.md): Frappe CRM before 1.74.0 Missing Authorization via add\_note\_to\_call\_log (CVSS 5.3)
- [CVE-2026-111937](https://cve.now/CVE-2026-111937.md): Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records (CVSS 5.3)
- [CVE-2026-64862](https://cve.now/CVE-2026-64862.md): Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS (CVSS 6.5)
- [CVE-2026-55796](https://cve.now/CVE-2026-55796.md): Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report (CVSS 6.5)
- [CVE-2026-108373](https://cve.now/CVE-2026-108373.md): ERPNext: Unauthorised access to financial data due to missing validation (CVSS 6.5)
- [CVE-2026-108374](https://cve.now/CVE-2026-108374.md): ERPNext: Unauthorised status modification due to missing validation (CVSS 7.7)
- [CVE-2026-111389](https://cve.now/CVE-2026-111389.md): Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation (CVSS 8.3)
- [CVE-2026-111388](https://cve.now/CVE-2026-111388.md): Frappe before 16.33.0 restrict\_ip Allowlist Bypass via API Key, OAuth Authentication (CVSS 5.3)
- [CVE-2026-55823](https://cve.now/CVE-2026-55823.md): Frappe: Possibility of SQL injection in reportview (CVSS 8.7)
- [CVE-2026-66057](https://cve.now/CVE-2026-66057.md): Frappe: Open Redirect via Unsanitized OAuth State Param. (CVSS 5.1)
- [CVE-2026-109675](https://cve.now/CVE-2026-109675.md): Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs (CVSS 5.3)
- [CVE-2026-109674](https://cve.now/CVE-2026-109674.md): Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation (CVSS 7.1)
- [CVE-2026-109673](https://cve.now/CVE-2026-109673.md): Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names (CVSS 8.5)
- [CVE-2026-109672](https://cve.now/CVE-2026-109672.md): Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data (CVSS 7.1)
- [CVE-2026-109671](https://cve.now/CVE-2026-109671.md): Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages (CVSS 8.5)
- [CVE-2026-109670](https://cve.now/CVE-2026-109670.md): Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name (CVSS 5.1)
- [CVE-2026-109669](https://cve.now/CVE-2026-109669.md): Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification (CVSS 5.3)
- [CVE-2026-109668](https://cve.now/CVE-2026-109668.md): Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints (CVSS 5.3)
- [CVE-2026-109667](https://cve.now/CVE-2026-109667.md): Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation (CVSS 8.7)
- [CVE-2026-109666](https://cve.now/CVE-2026-109666.md): Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints (CVSS 7.1)
- [CVE-2026-109665](https://cve.now/CVE-2026-109665.md): Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation (CVSS 5.3)
- [CVE-2026-109664](https://cve.now/CVE-2026-109664.md): Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification (CVSS 5.3)
- [CVE-2026-109663](https://cve.now/CVE-2026-109663.md): Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters (CVSS 7.1)
- [CVE-2026-109662](https://cve.now/CVE-2026-109662.md): Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form (CVSS 5.3)
- [CVE-2026-109661](https://cve.now/CVE-2026-109661.md): Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data (CVSS 7.1)
- [CVE-2026-109660](https://cve.now/CVE-2026-109660.md): Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints (CVSS 7.1)
- [CVE-2026-109659](https://cve.now/CVE-2026-109659.md): Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data (CVSS 7.1)
- [CVE-2026-109658](https://cve.now/CVE-2026-109658.md): Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints (CVSS 7.1)
- [CVE-2026-109657](https://cve.now/CVE-2026-109657.md): Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name (CVSS 5.1)
- [CVE-2026-109656](https://cve.now/CVE-2026-109656.md): Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access (CVSS 7.1)
- [CVE-2026-109655](https://cve.now/CVE-2026-109655.md): Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints (CVSS 7.1)
- [CVE-2026-109654](https://cve.now/CVE-2026-109654.md): Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints (CVSS 5.3)
- [CVE-2026-109653](https://cve.now/CVE-2026-109653.md): Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover (CVSS 8.5)
- [CVE-2026-109652](https://cve.now/CVE-2026-109652.md): Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields (CVSS 8.7)
- [CVE-2026-109651](https://cve.now/CVE-2026-109651.md): Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field (CVSS 5.3)
- [CVE-2026-109650](https://cve.now/CVE-2026-109650.md): Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data (CVSS 7.1)
- [CVE-2026-109649](https://cve.now/CVE-2026-109649.md): Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests (CVSS 7.1)
- [CVE-2026-109648](https://cve.now/CVE-2026-109648.md): Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation (CVSS 7.1)
- [CVE-2026-109647](https://cve.now/CVE-2026-109647.md): Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation (CVSS 7.1)
- [CVE-2026-109646](https://cve.now/CVE-2026-109646.md): Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation (CVSS 7.1)
- [CVE-2026-109645](https://cve.now/CVE-2026-109645.md): Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization (CVSS 7.1)
- [CVE-2026-109644](https://cve.now/CVE-2026-109644.md): Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data (CVSS 7.1)
- [CVE-2026-109643](https://cve.now/CVE-2026-109643.md): Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data (CVSS 7.1)
- [CVE-2026-109642](https://cve.now/CVE-2026-109642.md): Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints (CVSS 5.3)
- [CVE-2026-109641](https://cve.now/CVE-2026-109641.md): Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints (CVSS 6.9)
- [CVE-2026-109640](https://cve.now/CVE-2026-109640.md): Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification (CVSS 7.2)
- [CVE-2026-109639](https://cve.now/CVE-2026-109639.md): Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests (CVSS 7.1)
- [CVE-2026-109638](https://cve.now/CVE-2026-109638.md): Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation (CVSS 7.1)
- [CVE-2026-109637](https://cve.now/CVE-2026-109637.md): Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification (CVSS 7.1)
- [CVE-2026-109636](https://cve.now/CVE-2026-109636.md): Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data (CVSS 7.1)
- [CVE-2026-109635](https://cve.now/CVE-2026-109635.md): Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints (CVSS 5.3)
- [CVE-2026-109634](https://cve.now/CVE-2026-109634.md): Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints (CVSS 6.9)
- [CVE-2026-109633](https://cve.now/CVE-2026-109633.md): Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page (CVSS 8.6)
- [CVE-2026-109632](https://cve.now/CVE-2026-109632.md): Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints (CVSS 7.1)
- [CVE-2026-109631](https://cve.now/CVE-2026-109631.md): Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation (CVSS 7.1)
- [CVE-2026-109630](https://cve.now/CVE-2026-109630.md): Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints (CVSS 5.3)
- [CVE-2026-109629](https://cve.now/CVE-2026-109629.md): Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint (CVSS 5.3)
- [CVE-2026-109628](https://cve.now/CVE-2026-109628.md): Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization (CVSS 7.1)
- [CVE-2026-109627](https://cve.now/CVE-2026-109627.md): Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data (CVSS 7.1)
- [CVE-2026-109626](https://cve.now/CVE-2026-109626.md): Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints (CVSS 7.1)
- [CVE-2026-109625](https://cve.now/CVE-2026-109625.md): Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data (CVSS 7.1)
- [CVE-2026-109624](https://cve.now/CVE-2026-109624.md): Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data (CVSS 7.1)
- [CVE-2026-109623](https://cve.now/CVE-2026-109623.md): Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization (CVSS 5.3)
- [CVE-2026-109622](https://cve.now/CVE-2026-109622.md): Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization (CVSS 5.3)
- [CVE-2026-109621](https://cve.now/CVE-2026-109621.md): Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass (CVSS 7.1)
- [CVE-2026-109617](https://cve.now/CVE-2026-109617.md): Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints (CVSS 7.1)
- [CVE-2026-109616](https://cve.now/CVE-2026-109616.md): Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification (CVSS 7.1)
- [CVE-2026-109615](https://cve.now/CVE-2026-109615.md): Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints (CVSS 7.1)
- [CVE-2026-109614](https://cve.now/CVE-2026-109614.md): Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data (CVSS 7.1)
- [CVE-2026-109613](https://cve.now/CVE-2026-109613.md): Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification (CVSS 7.1)
- [CVE-2026-109612](https://cve.now/CVE-2026-109612.md): Frappe ERPNext before 15.120.0 Stored XSS via Report View (CVSS 8.5)
- [CVE-2026-109611](https://cve.now/CVE-2026-109611.md): Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints (CVSS 5.3)
- [CVE-2026-109610](https://cve.now/CVE-2026-109610.md): Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification (CVSS 7.1)
- [CVE-2026-109609](https://cve.now/CVE-2026-109609.md): Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation (CVSS 7.1)
- [CVE-2026-109608](https://cve.now/CVE-2026-109608.md): Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input (CVSS 8.7)
- [CVE-2026-109604](https://cve.now/CVE-2026-109604.md): ERPNext before 15.112.0 Stored XSS via Tool View Record Names (CVSS 8.5)
- [CVE-2026-109603](https://cve.now/CVE-2026-109603.md): Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit (CVSS 4.8)
- [CVE-2026-109602](https://cve.now/CVE-2026-109602.md): Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters (CVSS 5.1)
- [CVE-2026-109601](https://cve.now/CVE-2026-109601.md): Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML (CVSS 8.2)
- [CVE-2026-109600](https://cve.now/CVE-2026-109600.md): Frappe before 16.31.0 Improper Access Control in Document Follow Notifications (CVSS 6.9)
- [CVE-2026-109599](https://cve.now/CVE-2026-109599.md): Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification (CVSS 5.3)
- [CVE-2026-109598](https://cve.now/CVE-2026-109598.md): Frappe before 16.33.0 Broken Authorization via send\_sms Endpoint (CVSS 5.3)
- [CVE-2025-71432](https://cve.now/CVE-2025-71432.md): Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover (CVSS 8.6)
- [CVE-2025-71431](https://cve.now/CVE-2025-71431.md): Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters (CVSS 6.3)
- [CVE-2025-71430](https://cve.now/CVE-2025-71430.md): Frappe before 15.91.1 Stored XSS via Leaderboard User Names (CVSS 5.1)
- [CVE-2024-58391](https://cve.now/CVE-2024-58391.md): Frappe before 15.4.0 XSS via Printview Parameters (CVSS 5.3)
- [CVE-2024-58390](https://cve.now/CVE-2024-58390.md): Frappe before 15.41.0 Privilege Escalation via Document Action (CVSS 8.7)
- [CVE-2023-54412](https://cve.now/CVE-2023-54412.md): Frappe before 13.46.3 Improper Access Control for Email Templates (CVSS 7.1)
- [CVE-2023-54411](https://cve.now/CVE-2023-54411.md): Frappe before 13.32.0 Weak Authentication via Print View Key (CVSS 8.2)
- [CVE-2023-54410](https://cve.now/CVE-2023-54410.md): Frappe before 13.22.0 Improper Authorization via Document Rename (CVSS 5.3)
- [CVE-2023-54409](https://cve.now/CVE-2023-54409.md): Frappe before 13.46.1 XSS via html2text Weak Sanitization (CVSS 5.9)
- [CVE-2023-54408](https://cve.now/CVE-2023-54408.md): Frappe before 14.31.0 HTML Injection via Weak Escaping (CVSS 5.1)
- [CVE-2023-54407](https://cve.now/CVE-2023-54407.md): Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks (CVSS 6.9)
- [CVE-2023-54406](https://cve.now/CVE-2023-54406.md): Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts (CVSS 6.9)
- [CVE-2026-109377](https://cve.now/CVE-2026-109377.md): ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods (CVSS 5.3)
- [CVE-2026-109376](https://cve.now/CVE-2026-109376.md): ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get\_timesheet\_html (CVSS 5.3)
- [CVE-2026-108734](https://cve.now/CVE-2026-108734.md): Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get\_linked\_docs\_of\_document (CVSS 5.3)
- [CVE-2026-108733](https://cve.now/CVE-2026-108733.md): Frappe HR (hrms) before 16.11.0 Missing Authorization via expire\_allocation (CVSS 5.3)
- [CVE-2026-108732](https://cve.now/CVE-2026-108732.md): Frappe HR (hrms) before 16.11.0 Missing Authorization via get\_account\_and\_amount (CVSS 5.3)
- [CVE-2026-101006](https://cve.now/CVE-2026-101006.md): Frappe HR Permission Validation \_\_init\_\_.py get\_attendance\_requests authorization (CVSS 5.3)
- [CVE-2026-96672](https://cve.now/CVE-2026-96672.md): Frappe ERPNext before 16.34.1 Unauthorized Method Invocation (CVSS 5.3)
- [CVE-2026-94113](https://cve.now/CVE-2026-94113.md): Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints (CVSS 7.1)
- [CVE-2026-54343](https://cve.now/CVE-2026-54343.md): Frappe LMS: Path Traversal in SCORM File Serving (CVSS 8.7)
- [CVE-2026-54524](https://cve.now/CVE-2026-54524.md): Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report (CVSS 7.1)
- [CVE-2023-51769](https://cve.now/CVE-2023-51769.md): Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages. (CVSS 6.1)
- [CVE-2026-53761](https://cve.now/CVE-2026-53761.md): Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api (CVSS 8.2)
- [CVE-2026-82634](https://cve.now/CVE-2026-82634.md): Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint (CVSS 7.1)
- [CVE-2026-81731](https://cve.now/CVE-2026-81731.md): Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description (CVSS 5.1)
- [CVE-2026-66003](https://cve.now/CVE-2026-66003.md): Frappe: Access control bypass via REST API dot-notation fields on linked doctypes (CVSS 7.1)
- [CVE-2026-66002](https://cve.now/CVE-2026-66002.md): Frappe: User Enumeration via PDDR (CVSS 6.9)
- [CVE-2026-66001](https://cve.now/CVE-2026-66001.md): Frappe: Improper Authorization in OAuth2 Consent Endpoint (CVSS 8.5)
- [CVE-2026-62315](https://cve.now/CVE-2026-62315.md): Frappe: Mass assignment via set\_value (CVSS 7.1)
- [CVE-2026-63654](https://cve.now/CVE-2026-63654.md): Frappe: Unauthenticated Workflow approval via confirm\_action (CVSS 6.9)
- [CVE-2026-53569](https://cve.now/CVE-2026-53569.md): Frappe: Missing authorization in toggle\_like and mark\_as\_seen (CVSS 5.3)
- [CVE-2026-65822](https://cve.now/CVE-2026-65822.md): ERPNext: SQL Injection in "Inactive Customers" report via unvalidated \`doctype\` filter (CVSS 7.6)
- [CVE-2026-65974](https://cve.now/CVE-2026-65974.md): ERPNext: Server-Side Template Injection leading to Remote Code Execution (CVSS 9.9)
- [CVE-2026-72911](https://cve.now/CVE-2026-72911.md): ERPNext: Possibility of server-side template injection due to missing validation (CVSS 9.9)
- [CVE-2026-72910](https://cve.now/CVE-2026-72910.md): ERPNext: Unauthorised modification of master data due to missing validation (CVSS 7.1)
- [CVE-2026-72909](https://cve.now/CVE-2026-72909.md): ERPNext: Broken Access Control on certain endpoints (CVSS 7.1)
- [CVE-2026-72908](https://cve.now/CVE-2026-72908.md): ERPNext: Possibility of SQL injection due to missing validation (CVSS 6.5)
- [CVE-2026-72907](https://cve.now/CVE-2026-72907.md): ERPNext: Broken Access Control on certain endpoint (CVSS 6.5)
- [CVE-2026-72906](https://cve.now/CVE-2026-72906.md): ERPNext: Unauthorised triggering of automated emails due to missing validation (CVSS 4.3)
- [CVE-2026-66000](https://cve.now/CVE-2026-66000.md): Frappe: Unrestricted access to Document Follow APIs (CVSS 2.3)
- [CVE-2025-58375](https://cve.now/CVE-2025-58375.md): Frappe has potential SQL Injection due to missing validation (CVSS 8.1)
- [CVE-2026-66058](https://cve.now/CVE-2026-66058.md): Frappe: Unrestricted access to a Document Follow API (CVSS 5.3)
- [CVE-2026-66059](https://cve.now/CVE-2026-66059.md): Frappe: Field-level permission bypass via Document Follow (CVSS 5.3)
- [CVE-2026-49391](https://cve.now/CVE-2026-49391.md): Frappe: Stored XSS in Column Headers via Data Import (CVSS 5.1)
- [CVE-2026-47765](https://cve.now/CVE-2026-47765.md): Frappe: Lack of Permissions in restore/bulk\_restore (CVSS 7.1)
- [CVE-2026-47194](https://cve.now/CVE-2026-47194.md): Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain (CVSS 8.6)
- [CVE-2026-47185](https://cve.now/CVE-2026-47185.md): Frappe Has Broken Access Control in its Workspace Save API (CVSS 5.1)
- [CVE-2026-13227](https://cve.now/CVE-2026-13227.md): ERPNext v16.25.0 - Improper authorization in Prospect opportunities API (CVSS 7.1)
- [CVE-2026-12895](https://cve.now/CVE-2026-12895.md): SQL Injection in Frappe's ERPNext (CVSS 7.1)
- [CVE-2026-39385](https://cve.now/CVE-2026-39385.md): Frappe LMS enrollment bypass in paid courses via unrelated batch (CVSS 7.1)
- [CVE-2026-55242](https://cve.now/CVE-2026-55242.md): ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming\_series\_prefix (CVSS 8.8)
- [CVE-2026-55852](https://cve.now/CVE-2026-55852.md): Frappe: TarSlip RCE in Package Import (CVSS 8.6)
- [CVE-2026-42219](https://cve.now/CVE-2026-42219.md): Frappe: Path Traversal via /backups Route (CVSS 6.9)
- [CVE-2026-49394](https://cve.now/CVE-2026-49394.md): Frappe: Auth. bypass via update\_page (CVSS 7.1)
- [CVE-2026-48127](https://cve.now/CVE-2026-48127.md): Frappe: Arbitrary Attachment Injection via add\_attachments and upload\_file (CVSS 5.3)
- [CVE-2026-41482](https://cve.now/CVE-2026-41482.md): Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator (CVSS 7.1)
- [CVE-2026-47199](https://cve.now/CVE-2026-47199.md): Frappe: check\_safe\_sql\_query Permits SELECT INTO OUTFILE (CVSS 2.3)
- [CVE-2026-58503](https://cve.now/CVE-2026-58503.md): Frappe: Unauthenticated User Enumeration via reset\_password (CVSS 6.9)
- [CVE-2026-47422](https://cve.now/CVE-2026-47422.md): Frappe: Unrestricted API access to save\_report (CVSS 5.3)
- [CVE-2026-50712](https://cve.now/CVE-2026-50712.md): Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering (CVSS 4.8)
- [CVE-2026-50711](https://cve.now/CVE-2026-50711.md): Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering (CVSS 4.6)
- [CVE-2026-50710](https://cve.now/CVE-2026-50710.md): Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters\_config (CVSS 4.6)
- [CVE-2026-50709](https://cve.now/CVE-2026-50709.md): Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering (CVSS 4.8)
- [CVE-2026-50708](https://cve.now/CVE-2026-50708.md): Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering (CVSS 4.8)
- [CVE-2026-50705](https://cve.now/CVE-2026-50705.md): Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering (CVSS 4.6)
- [CVE-2026-50704](https://cve.now/CVE-2026-50704.md): Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering (CVSS 4.6)
- [CVE-2026-50703](https://cve.now/CVE-2026-50703.md): Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering (CVSS 4.8)
- [CVE-2026-50701](https://cve.now/CVE-2026-50701.md): Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering (CVSS 5.1)
- [CVE-2026-50700](https://cve.now/CVE-2026-50700.md): Frappe Framework 17.0.0-dev - Stored XSS in frappe.get\_avatar image rendering (CVSS 4.6)
- [CVE-2026-50699](https://cve.now/CVE-2026-50699.md): Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering (CVSS 4.6)
- [CVE-2026-50698](https://cve.now/CVE-2026-50698.md): Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering (CVSS 4.6)
- [CVE-2026-53568](https://cve.now/CVE-2026-53568.md): Frappe: Stored XSS in Frappe Report/List View via 'set\_link\_title\_field\_value' (CVSS 6.9)
- [CVE-2026-50026](https://cve.now/CVE-2026-50026.md): Frappe: Lack of permissions checks in 'relink' and 'set\_email\_password' endpoints (CVSS 6.9)
- [CVE-2026-47182](https://cve.now/CVE-2026-47182.md): Frappe: Broken Access Control on Private Files (CVSS 5.3)
- [CVE-2026-44976](https://cve.now/CVE-2026-44976.md): Frappe: IDOR in update\_onboarding\_step (CVSS 5.3)
- [CVE-2026-44975](https://cve.now/CVE-2026-44975.md): Frappe: Missing authorization on reset form tours (CVSS 5.3)
- [CVE-2026-44206](https://cve.now/CVE-2026-44206.md): Frappe: DB Schema Enumeration via Frappe-Authorization-Source (CVSS 6.9)
- [CVE-2026-44207](https://cve.now/CVE-2026-44207.md): Frappe: Insecure Direct Object Reference for email accounts (CVSS 6.9)
- [CVE-2026-44208](https://cve.now/CVE-2026-44208.md): Frappe: IDOR in \`submit\_discussion()\` (CVSS 6.9)
- [CVE-2026-44205](https://cve.now/CVE-2026-44205.md): Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload (CVSS 6.9)
- [CVE-2026-41581](https://cve.now/CVE-2026-41581.md): Frappe Vulnerable to Possible SQL Injection via get\_blog\_list (CVSS 6.9)
- [CVE-2026-47739](https://cve.now/CVE-2026-47739.md): Frappe: Stored XSS in Note (CVSS 6.9)
- [CVE-2026-46546](https://cve.now/CVE-2026-46546.md): Frappe LMS: HTML injection in user-controlled metadata (CVSS 2.1)
- [CVE-2026-42839](https://cve.now/CVE-2026-42839.md): ERPNext 16.16.0 - Stored XSS in POS cart item rendering (CVSS 4.8)
- [CVE-2026-42840](https://cve.now/CVE-2026-42840.md): ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals (CVSS 5.1)
- [CVE-2026-45081](https://cve.now/CVE-2026-45081.md): Frappe HR: Permission Bypass in HRMS Leave Details API (CVSS 6.5)
- [CVE-2026-39405](https://cve.now/CVE-2026-39405.md): Frappe has Path Transversal via SCORM (CVSS 9.4)
- [CVE-2026-39352](https://cve.now/CVE-2026-39352.md): Frappe has an Arbitrary File Read via Path Traversal in render\_include (CVSS 8.7)
- [CVE-2026-44448](https://cve.now/CVE-2026-44448.md): ERPNext: Unauthorised Document modification due to missing validation (CVSS 5.9)
- [CVE-2026-44447](https://cve.now/CVE-2026-44447.md): ERPNext: Possibility of SQL Injection due to missing validation (CVSS 8.8)
- [CVE-2026-44446](https://cve.now/CVE-2026-44446.md): ERPNext: Possibility of SQL Injection due to missing validation (CVSS 8.8)
- [CVE-2026-44445](https://cve.now/CVE-2026-44445.md): ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module (CVSS 5.3)
- [CVE-2026-44441](https://cve.now/CVE-2026-44441.md): ERPNext: Possible SSRF by any authenticated user (CVSS 5.0)
- [CVE-2026-44440](https://cve.now/CVE-2026-44440.md): ERPNext: Path Traversal Leading to Sensitive File Exposure (CVSS 6.5)
- [CVE-2026-44442](https://cve.now/CVE-2026-44442.md): ERPNext: Unauthorised Document modification due to missing validation (CVSS 9.9)
- [CVE-2026-41430](https://cve.now/CVE-2026-41430.md): Press vulnerable to reflected XSS on login redirection (CVSS 1.3)
- [CVE-2026-41317](https://cve.now/CVE-2026-41317.md): Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation (CVSS 6.6)
- [CVE-2026-3837](https://cve.now/CVE-2026-3837.md): Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters (CVSS 4.6)
- [CVE-2026-3673](https://cve.now/CVE-2026-3673.md): Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer (CVSS 4.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/frappe
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.