CVE-2026-109665 Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation

Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted...

CVE-2026-109656

Frappe ERPNext versions before 15.118.2 and 16.x before 16.30.0 are vulnerable to a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce proper authorization checks on item master data . This allows authenticated attackers with low-privileged accounts to call these end...

CVE-2026-109656 Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access

Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data...

CVE-2026-109656 Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access

Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data...

CVE-2026-109637 Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records...

CVE-2026-109637

Frappe ERPNext versions before 16.14.0 are susceptible to a missing authorization vulnerability (CWE-862). This flaw allows authenticated users to bypass role-based restrictions and perform unauthorized modifications to master data records. The issue stems from specific endpoints lacking proper a...

CVE-2026-109637 Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records...

CVE-2026-107862

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

EUVD-2026-97723

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-107862 WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-107862

The ExpressTech Quiz And Survey Master (quiz-master-next) WordPress plugin, versions up to and including 11.2.7 , is vulnerable to a DOM-Based Cross-Site Scripting (XSS) . This flaw arises from the improper neutralization of input during web page generation. An attacker could potentially execute ...

WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Quiz And Survey Master versions = 11.2.7...

CVE-2026-109188

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or...

EUVD-2026-97392

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or...

CVE-2026-109188 jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or...

CVE-2026-109188 jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or...

CVE-2026-109188

The jshERP software, through version 3.6 , is vulnerable to a missing authorization vulnerability (CWE-862). This flaw allows low-privilege authenticated users to bypass role checks and create tenant-wide master data by sending POST requests to specific endpoints. Affected endpoints include /acco...

CVE-2026-109637: Missing Authorization

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records...

CVE-2026-109665: Missing Authorization

Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted...

CVE-2026-109188: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or...