CVE-2026-109604 ERPNext before 15.112.0 Stored XSS via Tool View Record Names

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the...

CVE-2026-109602 Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who vie...

CVE-2026-109602

The Frappe framework (versions before 15.118.0 and 16.x before 16.31.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw within the dashboard chart filters. The root cause is that jQuery renders entered filter values as rich text without sufficient sanitization. This allows authenticate...

CVE-2025-71432 Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted UR...

CVE-2025-71432

Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is missing input validation on a specific page, which enables the execution of arbitrary JavaScript within authenticated user sessions. A remote at...

CVE-2023-54412

The Frappe application (versions before 13.46.3 and 14.x before 14.21.1 ) contains an improper access control vulnerability within the Email Template permissions. This flaw allows any authenticated non-guest user , including low-privileged self-registered users, to create and edit any Email Templ...

CVE-2023-54412 Frappe before 13.46.3 Improper Access Control for Email Templates

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...

CVE-2023-54410 Frappe before 13.22.0 Improper Authorization via Document Rename

Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper...

CVE-2026-84316

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84320

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...

CVE-2026-84313

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otpenroll and POST /api/finishpasskeyregister are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind a...

CVE-2026-84314

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up...

CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-109562

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

CVE-2026-84316 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84316

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84316 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84319 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivale...

CVE-2026-84319

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivale...

CVE-2026-84317

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write...