EUVD-2026-34157

An authenticated user can persist arbitrary HTML/JavaScript in the emailid or mobileno fields of a Customer record and trigger unescaped rendering in the Point of Sale POS interface for every operator who selects that customer. This issue affects ERPNext: 16.16.0...

CVE-2025-66439

ERPNext through 15.89.0 is affected by an SQL Injection in get_outstanding_reference_documents() (erpnext.accounts.doctype.payment_entry.payment_entry.py) where from_posting_date is interpolated directly into the query. This allows an attacker to extract arbitrary data from the database. Connecte...

CVE-2025-52042

In Frappe ERPNext 15.57.5, the function getrfqcontainingsupplier at erpnext/buying/doctype/requestforquotation/requestforquotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter...