Known vulnerabilities in ERPNext - page 2

Vendor: Frappe
Software: ERPNext
Software CPE: cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Total vulnerabilities: 90
Public exploits: 0
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ERPNext ERPNext is affected by 90 known vulnerabilities: 4 high, 27 medium, 59 low Critical High Medium Low

Vulnerabilities (90)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU142526 - Missing Authorization
CVE-2026-109643
CWE-862 Low
No
No
15.111.0, 16.22.0 14.08.2026 SB2026073010
#VU142409 - Missing Authorization
CVE-2026-109672
CWE-862 Low
No
No
15.118.0, 16.27.0 13.08.2026 SB2026081374
#VU142401 - Missing Authorization
CVE-2026-109661
CWE-862 Low
No
No
15.116.0, 16.27.0 13.08.2026 SB2026081374
#VU142397 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-109657
CWE-79 Low
No
No
16.27.0 13.08.2026 SB2026081374
#VU142396 - Missing Authorization
CVE-2026-109656
CWE-862 Low
No
No
15.118.2, 16.30.0 13.08.2026 SB2026081378
#VU142395 - Missing Authorization
CVE-2026-109654
CWE-862 Low
No
No
15.119.0, 16.31.0 13.08.2026 SB2026081376
#VU142389 - Missing Authorization
CVE-2026-109645
CWE-862 Low
No
No
15.119.0, 16.31.0 13.08.2026 SB2026081376
#VU142388 - Missing Authorization
CVE-2026-109644
CWE-862 Low
No
No
15.119.0, 16.31.0 13.08.2026 SB2026081376
#VU142387 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-65822
CWE-89 Low
No
No
15.116.0, 16.23.0 13.08.2026 SB2026081374
#VU142383 - Missing Authorization
CVE-2026-109667
CWE-862 Medium
No
No
15.111.0, 16.22.0 13.08.2026 SB2026073010
#VU142379 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-109653
CWE-79 Low
No
No
15.119.0, 16.31.0 13.08.2026 SB2026081376
#VU142376 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-72911
CWE-1336 Medium
No
No
15.118.0, 16.29.0 13.08.2026 SB2026081374
#VU142375 - Missing Authorization
CVE-2026-72906
CWE-862 Low
No
No
15.111.0, 16.22.0 13.08.2026 SB2026073010
#VU140795 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-65974
CWE-1336 Medium
No
No
15.111.0, 16.22.0 03.08.2026 SB2026073010
#VU140049 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-12895
CWE-89 Medium
No
No
15.111.0, 16.22.0 30.07.2026 SB2026073010
#VU34064 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-6145
CWE-89 Medium
No
No
11.1.39 05.08.2020 SB2020080512
#VU34721 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20520
CWE-79 Low
No
No
- 19.03.2020 SB2020031832
#VU34722 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-20521
CWE-79 Low
No
No
- 19.03.2020 SB2020031832
#VU34728 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2019-20511
CWE-74 Medium
No
No
- 18.03.2020 SB2020031832
#VU36303 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2018-20061
CWE-89 Medium
No
No
11.0.3 11.12.2018 SB2018121129


Showing elements 21 - 40 out of 90