Known vulnerabilities in ERPNext - page 3

Vendor: Frappe
Software: ERPNext
Software CPE: cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Total vulnerabilities: 87
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ERPNext ERPNext is affected by 87 known vulnerabilities: 4 high, 26 medium, 57 low Critical High Medium Low

Vulnerabilities (87)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU142682 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Low
No
No
15.102.0, 16.8.0 15.08.2026 SB2026043025
#VU142679 - Missing Authorization
CWE-862 Low
No
No
16.14.0 15.08.2026 SB2026043027
#VU142678 - Missing Authorization
CWE-862 Low
No
No
15.115.0, 16.26.0 15.08.2026 SB2026080511
#VU142526 - Missing Authorization
CWE-862 Low
No
No
15.111.0, 16.22.0 14.08.2026 SB2026073010
#VU142398 - Missing Authorization
CWE-862 Low
No
No
15.115.0, 16.26.0 13.08.2026 SB2026080511
#VU142393 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Low
No
No
15.102.0, 16.11.0 13.08.2026 SB2026043025
#VU142392 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Low
No
No
15.106.0, 16.16.0 13.08.2026 SB2026043024
#VU142383 - Missing Authorization
CWE-862 Medium
No
No
15.111.0, 16.22.0 13.08.2026 SB2026073010
#VU142381 - Missing Authorization
CWE-862 Low
No
No
15.115.0, 16.26.0 13.08.2026 SB2026080511
#VU142375 - Missing Authorization
CVE-2026-72906
CWE-862 Low
No
No
15.111.0, 16.22.0 13.08.2026 SB2026073010
#VU140956 - Missing Authorization
CVE-2026-72910
CWE-862 Medium
No
No
15.112.0, 16.22.0 05.08.2026 SB2026080512
#VU140955 - Missing Authorization
CVE-2026-13227
CWE-862 Medium
No
No
15.115.0, 16.26.0 05.08.2026 SB2026080511
#VU140796 - Improper Authorization
CVE-2026-72907
CWE-285 Low
No
No
15.112.0, 16.23.0 03.08.2026 SB2026080378
#VU140795 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-65974
CWE-1336 Medium
No
No
15.111.0, 16.22.0 03.08.2026 SB2026073010
#VU140050 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-72908
CWE-89 Medium
No
No
15.109.0, 16.20.0 30.07.2026 SB2026073011
#VU140049 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-12895
CWE-89 Medium
No
No
15.111.0, 16.22.0 30.07.2026 SB2026073010
#VU137033 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-55242
CWE-1336 Low
No
No
15.111.0, 16.22.0 07.07.2026 SB2026070773
#VU128506 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-44446
CWE-89 Medium
No
No
15.104.3, 16.14.0 30.04.2026 SB2026043027
#VU128505 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-44447
CWE-89 Medium
No
No
16.9.0 30.04.2026 SB2026043026
#VU128504 - Missing Authorization
CVE-2026-44448
CWE-862 Low
No
No
15.102.0, 16.11.0 30.04.2026 SB2026043025


Showing elements 41 - 60 out of 87