Frappe vulnerabilities
266 CVEs and advisories name Frappe as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-109643Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
- CVE-2026-109642Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
- CVE-2026-109641Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
- CVE-2026-109640Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
- CVE-2026-109639Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
- CVE-2026-109638Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
- CVE-2026-109637Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
- CVE-2026-109636Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
- CVE-2026-109635Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
- CVE-2026-109634Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints
- CVE-2026-109633Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
- CVE-2026-109632Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints
- CVE-2026-109631Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation
- CVE-2026-109630Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints
- CVE-2026-109629Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint
- CVE-2026-109628Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization
- CVE-2026-109627Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data
- CVE-2026-109626Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints
- CVE-2026-109625Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data
- CVE-2026-109624Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data
- CVE-2026-109623Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization
- CVE-2026-109622Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization
- CVE-2026-109621Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
- CVE-2026-109617Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints
- CVE-2026-109616Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification
- CVE-2026-109615Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
- CVE-2026-109614Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
- CVE-2026-109613Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification
- CVE-2026-109612Frappe ERPNext before 15.120.0 Stored XSS via Report View
- CVE-2026-109611Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints