Approved changes feed: RSS · Atom
cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Frappe (a51f8b94-1fb6-5e30-97d7-fbeb544c71ba) |
|---|---|
| Product | Erpnext (bd490dec-a7c0-525e-8fd2-591f39522182) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/frappe/erpnext |
purl2cpe | 2026-06-01 10:17:00.627206 |
pkg:sourceforge/erpnext.mirror |
purl2cpe | 2026-06-01 10:17:00.627208 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-55242 |
vulnerable | 2026-07-29 01:00:28.415776 |
ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix
HIGH (8.8)
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.
Published: 2026-07-15T15:38:31.577Z
Updated: 2026-07-15T16:02:44.516Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44448 |
vulnerable | 2026-06-08 08:05:11.078081 |
ERPNext: Unauthorised Document modification due to missing validation
MEDIUM (5.9)
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 15.102.0 and 16.11.0.
Published: 2026-05-13T21:20:20.570Z
Updated: 2026-05-14T12:41:34.715Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44447 |
vulnerable | 2026-06-08 08:05:11.077766 |
ERPNext: Possibility of SQL Injection due to missing validation
HIGH (8.8)
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 16.9.0.
Published: 2026-05-13T21:19:07.916Z
Updated: 2026-05-15T18:33:57.673Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44446 |
vulnerable | 2026-06-08 08:05:11.077546 |
ERPNext: Possibility of SQL Injection due to missing validation
HIGH (8.8)
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0.
Published: 2026-05-13T21:18:17.477Z
Updated: 2026-05-14T13:31:08.843Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44445 |
vulnerable | 2026-06-08 08:05:11.077300 |
ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive configuration files. This vulnerability is fixed in 15.104.3 and 16.12.0.
Published: 2026-05-13T21:17:06.551Z
Updated: 2026-05-14T15:56:29.342Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44442 |
vulnerable | 2026-06-08 08:05:11.073871 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44441 |
vulnerable | 2026-06-08 08:05:11.073515 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44440 |
vulnerable | 2026-06-08 08:05:11.073098 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42840 |
vulnerable | 2026-06-08 08:03:16.808274 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42839 |
vulnerable | 2026-06-08 08:03:16.788637 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-38432 |
vulnerable | 2026-06-08 08:01:16.061728 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-38431 |
vulnerable | 2026-06-08 08:01:16.061014 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32954 |
vulnerable | 2026-06-08 07:57:18.382714 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27471 |
vulnerable | 2026-06-08 07:53:22.351509 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66440 |
vulnerable | 2026-06-08 07:41:18.929943 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66439 |
vulnerable | 2026-06-08 07:41:18.929507 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66438 |
vulnerable | 2026-06-08 07:41:18.929161 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66437 |
vulnerable | 2026-06-08 07:41:18.928672 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66436 |
vulnerable | 2026-06-08 07:41:18.928224 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66435 |
vulnerable | 2026-06-08 07:41:18.927831 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66434 |
vulnerable | 2026-06-08 07:41:18.927358 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65924 |
vulnerable | 2026-06-08 07:39:21.077729 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65923 |
vulnerable | 2026-06-08 07:39:21.077377 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58439 |
vulnerable | 2026-06-08 07:35:18.279219 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23058 |
vulnerable | 2026-06-08 05:40:56.118281 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23057 |
vulnerable | 2026-06-08 05:40:56.117866 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23056 |
vulnerable | 2026-06-08 05:40:56.115449 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23055 |
vulnerable | 2026-06-08 05:40:56.091421 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-20061 |
vulnerable | 2026-06-08 05:11:26.607338 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.