Known vulnerabilities in ERPNext - page 2

Vendor: Frappe
Software: ERPNext
Software CPE: cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Total vulnerabilities: 87
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ERPNext ERPNext is affected by 87 known vulnerabilities: 4 high, 26 medium, 57 low Critical High Medium Low

Vulnerabilities (87)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151471 - Missing Authorization
CWE-862 Low
No
No
15.119.1, 16.32.0 20.09.2026 SB2026081375
#VU151470 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Low
No
No
15.119.1, 16.32.0 20.09.2026 SB2026081375
#VU142683 - Missing Authorization
CWE-862 Medium
No
No
16.22.0 15.08.2026 SB2026081377
#VU142527 - Missing Authorization
CWE-862 Low
No
No
15.112.0 14.08.2026 SB2026080513
#VU142409 - Missing Authorization
CWE-862 Low
No
No
15.118.0, 16.27.0 13.08.2026 SB2026081374
#VU142403 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Low
No
No
15.113.0, 16.22.0 13.08.2026 SB2026081377
#VU142402 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
15.112.0, 16.23.0 13.08.2026 SB2026080513
#VU142401 - Missing Authorization
CWE-862 Low
No
No
15.116.0, 16.27.0 13.08.2026 SB2026081374
#VU142400 - Missing Authorization
CWE-862 Low
No
No
15.112.0, 16.23.0 13.08.2026 SB2026080513
#VU142397 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
16.27.0 13.08.2026 SB2026081374
#VU142395 - Missing Authorization
CWE-862 Low
No
No
15.119.0, 16.31.0 13.08.2026 SB2026081376
#VU142394 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
15.112.0, 16.23.0 13.08.2026 SB2026080513
#VU142389 - Missing Authorization
CWE-862 Low
No
No
15.119.0, 16.31.0 13.08.2026 SB2026081376
#VU142388 - Missing Authorization
CWE-862 Low
No
No
15.119.0, 16.31.0 13.08.2026 SB2026081376
#VU142387 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-65822
CWE-89 Low
No
No
15.116.0, 16.23.0 13.08.2026 SB2026081374
#VU142379 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
15.119.0, 16.31.0 13.08.2026 SB2026081376
#VU142378 - Improper Neutralization of Special Elements Used in a Template Engine
CWE-1336 Medium
No
No
15.119.1, 16.32.0 13.08.2026 SB2026081375
#VU142377 - Missing Authorization
CWE-862 Low
No
No
15.112.0, 16.23.0 13.08.2026 SB2026080513
#VU142376 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-72911
CWE-1336 Medium
No
No
15.118.0, 16.29.0 13.08.2026 SB2026081374
#VU140957 - Improper Access Control
CVE-2026-72909
CWE-284 Medium
No
No
15.112.0, 16.23.0 05.08.2026 SB2026080513


Showing elements 21 - 40 out of 87