CVE-2025-28062

CVE-2025-28062 — Vulnerabilità CSRF al Furto di Account in ERPNext 14.82.1 , 14.74.3 📌 Riepilogo È stata scoperta una vulnerabilità Cross-Site Request Forgery CSRF in ERPNext 14.82.1 e 14.74.3 , che consente agli attaccanti di eseguire azioni non autorizzate come: Enumerazione degli utenti Furto...

CVE-2025-56380

CVE-2025-56380 — Iniezione SQL cieca basata sul tempo in Frappe / ERPNext frappe.client.getvalue 📌 Riepilogo È stata scoperta una vulnerabilità di iniezione SQL cieca basata sul tempo nell'endpoint API frappe.client.getvalue in Frappe Framework v15.72.4 presente anche nel codebase di ERPNext...

CVE-2025-56379

CVE-2025-56379 — ثغرة تخزين البرمجة النصية عبر المواقع XSS في ERPNext 15.67.0 / Frappe 15.72.4 📌 ملخص توجد ثغرة تخزين البرمجة النصية عبر المواقع XSS في وحدة المدونة في ERPNext v15.67.0 / Frappe v15.72.4. يمكن لمستخدم مصادق يملك صلاحية إنشاء أو تعديل مشاركات المدونة حقن كود HTML/JavaScript مُعدّ...

CVE-2022-28598

ERPNext - 12.29.0 Eine gespeicherte Cross-Site-Scripting-Schwachstelle XSS im Feld "lastknownversion" auf der Seite "My Setting" in ERPNext 12.29.0 ermöglicht es entfernten Angreifern, beliebige Web-Skripte oder HTML über einen manipulierten Site-Namen einzuschleusen, indem sie eine...

CVE-2025-56381

CVE-2025-56381 — SQL Injection autenticata in ERPNext / Frappe tramite i parametri orderby e groupby 📌 Sommario ERPNext v15.67.0 e Frappe Framework v15.72.4 contengono molteplici vulnerabilità di SQL injection autenticata nell'endpoint API frappe.desk.reportview.get. Input dannosi ai parametri...

CVE-2026-65822

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

CVE-2026-65974

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-65822 ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

CVE-2026-65822

In ERPNext versions before 15.116.0 and 16.23.0, the Inactive Customers report (inactive_customers.py) passes an unvalidated doctype filter directly into raw SQL via get_sales_details and get_last_sales_amt, enabling authenticated users to extract sensitive data and manipulate queries. CISA repor...

CVE-2026-65822 ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

CVE-2026-65974 ERPNext: Server-Side Template Injection leading to Remote Code Execution

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-65974

ERPNext (versions before 15.111.0 and 16.22.0) exposes frappe.render_template without enforcing restrict_globals in Frappe's safe-execution sandbox, allowing authenticated low-privilege users to perform server-side template injection and achieve remote code execution. The flaw is rated CVSS 9.9 (...

CVE-2026-65974 ERPNext: Server-Side Template Injection leading to Remote Code Execution

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-72906

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the sendautoemail function in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated...

CVE-2026-72908

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the gettaxtemplate function in erpnext/accounts/doctype/taxrule/taxrule.py constructs an SQL WHERE clause from request-influenced postingdate and args values, allowing an authenticated low-privileg...

CVE-2026-72907

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...

CVE-2026-72909

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-72911

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...

CVE-2026-72910

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py,...

CVE-2026-72911 ERPNext: Possibility of server-side template injection due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...