CVE-2022-28598

ERPNext - 12.29.0 ERPNext 12.29.0の「My Setting」ページにある「lastknownversion」フィールドに保存型クロスサイトスクリプティング（XSS）の脆弱性が存在します。リモートの攻撃者は、認証済みのPOST HTTPリクエストを「/deskForm/User/認証ユーザー」に送信し、細工したサイト名を使用して任意のWebスクリプトまたはHTMLを注入できます。スクリプトは「lastknownversion」フィールドに注入され、「pdf」表示フォームをクリックすることで確認できます。 この脆弱性は特に「My...

CVE-2025-28062

CVE-2025-28062 — ERPNext 14.82.1 和 14.74.3 中的 CSRF 漏洞可导致账户接管 📌 摘要 在 ERPNext 14.82.1 和 14.74.3 中发现了一个跨站请求伪造 CSRF 漏洞，允许攻击者执行未授权操作，例如： 用户枚举 账户接管（密码重置） 任意用户删除 权限提升（添加角色） 该漏洞源于关键管理 API 端点缺乏 CSRF 保护 。如果经过身份验证的管理员访问恶意网站，其会话将被滥用，从而在未经同意的情况下执行这些操作。 🛠 技术细节 漏洞类型： CSRF（CWE-352） 受影响产品： ERPNext 版本：...

CVE-2025-56380

CVE-2025-56380 — Frappe / ERPNext 中的基于时间的盲 SQL 注入（frappe.client.getvalue） 📌 摘要 在 Frappe Framework v15.72.4 的 frappe.client.getvalue API 端点中（以及 ERPNext v15.67.0 代码库中）发现了一个基于时间的盲 SQL 注入漏洞。具有 reporting/client API 访问权限的已认证用户可以通过 fieldname 参数注入 SQL。通过将时间延迟函数（例如 sleep15）插入 fieldname...

CVE-2025-56381

CVE-2025-56381 — ERPNext / Frappe 中通过 orderby 和 groupby 参数实现的身份验证后 SQL 注入 📌 摘要 ERPNext v15.67.0 和 Frappe Framework v15.72.4 在 frappe.desk.reportview.get API 端点中包含多个身份验证后的 SQL 注入漏洞 。对 orderby 或 groupby 参数的恶意输入可用于注入并执行任意 SQL 语句。这使得经过身份验证的用户（具有报表的基本访问权限）能够提取敏感数据、执行数据库枚举，并可能操纵或提升系统内的权限。 🛠 技术细节 漏洞类型：...

CVE-2025-56379

CVE-2025-56379 — ERPNext 15.67.0 / Frappe 15.72.4 中的存储型跨站脚本（XSS）漏洞 📌 摘要 ERPNext（v15.67.0）/ Frappe（v15.72.4）的博客模块中存在一个存储型跨站脚本（XSS）漏洞。可以创建或编辑博客文章的身份验证用户可以在 content 字段中注入精心构造的 HTML/JavaScript。该负载会被存储，并在任何查看博客文章页面的用户的浏览器中执行，从而允许任意脚本执行、信息泄露、拒绝服务和其他客户端攻击。管理员权限并非 严格要求——任何有权创建/编辑博客文章的用户均可利用该漏洞。 🛠 技术细节...

CVE-2026-65822

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

CVE-2026-65974

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-65822

In ERPNext versions before 15.116.0 and 16.23.0, the Inactive Customers report (inactive_customers.py) passes an unvalidated doctype filter directly into raw SQL via get_sales_details and get_last_sales_amt, enabling authenticated users to extract sensitive data and manipulate queries. CISA repor...

CVE-2026-65822 ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

CVE-2026-65822 ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

CVE-2026-65974 ERPNext: Server-Side Template Injection leading to Remote Code Execution

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-65974

ERPNext (versions before 15.111.0 and 16.22.0) exposes frappe.render_template without enforcing restrict_globals in Frappe's safe-execution sandbox, allowing authenticated low-privilege users to perform server-side template injection and achieve remote code execution. The flaw is rated CVSS 9.9 (...

CVE-2026-65974 ERPNext: Server-Side Template Injection leading to Remote Code Execution

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-72906

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the sendautoemail function in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated...

CVE-2026-72908

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the gettaxtemplate function in erpnext/accounts/doctype/taxrule/taxrule.py constructs an SQL WHERE clause from request-influenced postingdate and args values, allowing an authenticated low-privileg...

CVE-2026-72907

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...

CVE-2026-72911

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...

CVE-2026-72910

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py,...

CVE-2026-72909

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-72911 ERPNext: Possibility of server-side template injection due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...