GCVE - cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*

part: a version: 11.0.3 update: beta6

Vendor	Frappe (`a51f8b94-1fb6-5e30-97d7-fbeb544c71ba`)
Product	Erpnext (`bd490dec-a7c0-525e-8fd2-591f39522182`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/frappe/erpnext`	purl2cpe	2026-06-01 10:17:00.627611
`pkg:sourceforge/erpnext.mirror`	purl2cpe	2026-06-01 10:17:00.627612

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-23055`	vulnerable	2026-06-08 05:40:56.112369	ERPNext - Improper user access conrol In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users. Published: 2022-06-22T08:25:10.197Z Updated: 2024-09-16T17:53:19.267Z Open on db.gcve.eu Reference links https://www.mend.io/vulnerability-database/CVE-2022-23055 https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134 https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-20061`	vulnerable	2026-06-08 05:11:26.629066	Details available A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call. Published: 2018-12-11T17:00:00.000Z Updated: 2024-08-05T11:51:18.930Z Open on db.gcve.eu Reference links https://github.com/frappe/erpnext/issues/15337	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.