Frappe vulnerabilities
266 CVEs and advisories name Frappe as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-109673Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
- CVE-2026-109672Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
- CVE-2026-109671Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
- CVE-2026-109670Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
- CVE-2026-109669Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
- CVE-2026-109668Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
- CVE-2026-109667Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
- CVE-2026-109666Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
- CVE-2026-109665Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
- CVE-2026-109664Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
- CVE-2026-109663Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
- CVE-2026-109662Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
- CVE-2026-109661Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
- CVE-2026-109660Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
- CVE-2026-109659Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
- CVE-2026-109658Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
- CVE-2026-109657Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
- CVE-2026-109656Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
- CVE-2026-109655Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
- CVE-2026-109654Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
- CVE-2026-109653Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
- CVE-2026-109652Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
- CVE-2026-109651Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
- CVE-2026-109650Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
- CVE-2026-109649Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
- CVE-2026-109648Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
- CVE-2026-109647Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
- CVE-2026-109646Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
- CVE-2026-109645Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
- CVE-2026-109644Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data