EUVD-2026-85344

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-96672

Frappe ERPNext versions before 16.34.1 are vulnerable to an unauthorized method invocation due to insufficient validation of calculation_formula values within Financial Report Templates. The application fails to verify that these values reference whitelisted methods before passing them to frappe....

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...