CVE-2026-109674

The Frappe ERPNext application is vulnerable to an SQL injection vulnerability in versions prior to 15.98.0 and 16.x before 16.6.0. The root cause is missing input validation in certain endpoints, which allows remote authenticated attackers to submit specially crafted requests. Successful exploit...