CVE-2026-109663 Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive informati...

CVE-2026-109663 Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive informati...

CVE-2026-109663

Frappe ERPNext versions before 15.113.0 and 16.x before 16.22.0 are vulnerable to an SQL injection due to missing input validation in certain endpoints. Authenticated remote attackers can exploit this by sending specially crafted requests to manipulate database queries and extract sensitive infor...

CVE-2026-109649 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive...

CVE-2026-109649

Frappe ERPNext is vulnerable to an SQL injection in versions before 15.102.0 and 16.x before 16.11.0 . The root cause is missing input validation in certain endpoints, which allows an authenticated attacker to send specially crafted requests to manipulate database queries. Successful exploitation...

CVE-2026-109649 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive...

CVE-2026-109648 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

CVE-2026-109648 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

CVE-2026-109648 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

CVE-2026-109648

Frappe ERPNext versions before 15.106.0 and 16.x before 16.16.0 are vulnerable to an SQL injection due to missing input validation in certain endpoints. An authenticated attacker can submit specially crafted requests to execute malicious SQL commands, potentially resulting in the extraction of se...

CVE-2026-109647 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information...

CVE-2026-109647

Frappe ERPNext versions before 15.106.0 and 16.x before 16.16.0 are vulnerable to SQL injection across multiple endpoints. The root cause is missing input validation , which allows authenticated attackers to send specially crafted requests. This vulnerability enables the manipulation of database ...

CVE-2026-109647 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information...

CVE-2026-109646 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

CVE-2026-109646 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

CVE-2026-109646

Frappe ERPNext versions prior to 15.106.0 and 16.x before 16.16.0 are vulnerable to an SQL injection vulnerability. This flaw originates from missing input validation in certain endpoints, allowing authenticated low-privileged attackers to submit specially crafted requests. Successful exploitatio...

CVE-2026-109639 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to...

CVE-2026-109639 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to...

CVE-2026-109639

Frappe ERPNext versions prior to 15.102.0 and 16.x before 16.8.0 are vulnerable to an SQL injection vulnerability. The root cause is missing input validation in certain endpoints, which allows for the manipulation of database queries. Authenticated attackers with low privileges can exploit this b...

CVE-2026-109638

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are vulnerable to a SQL injection flaw in certain endpoints. The root cause is missing input validation , which allows authenticated attackers to submit specially crafted requests to manipulate database queries. This vulnerability ca...