Product by Frappe

    Frappe ERPNext

    144 known vulnerabilities in Frappe ERPNext (Frappe), 0 of them actively exploited (CISA KEV).

    Key figures

    144

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    12

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Frappe ERPNext (Frappe)
    CriticalCVE-2026-65974

    ERPNext: Server-Side Template Injection leading to Remote Code Execution

    		9.9
    MediumCVE-2022-28598

    Frappe ERPNext: Cross-Site Scripting (XSS)

    		6.1
    CriticalCVE-2026-72911

    ERPNext: Possibility of server-side template injection due to missing validation

    		9.9
    MediumCVE-2018-11339

    Frappe ERPNext: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2020-6145

    ERPNext: SQL Injection

    		6.4
    HighCVE-2023-54345

    Frappe Framework ERPNext 13.4.0 Remote Code Execution

    		8.8
    HighCVE-2018-20061

    Frappe ERPNext: SQL Injection

    		7.5
    HighCVE-2026-109652

    Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

    		8.8
    HighCVE-2026-109608

    Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input

    		8.8
    HighCVE-2026-109667

    Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

    		8.8
    HighCVE-2025-71432

    Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover

    		8.1
    HighCVE-2025-66437

    Frappe ERPNext: Template Injection

    		8.8
    HighCVE-2025-66434

    Frappe ERPNext: Template Injection

    		8.8
    HighCVE-2026-109633

    Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page

    		8.1
    HighCVE-2025-28062

    Frappe ERPNext: Cross-Site Request Forgery (CSRF)

    		8.1
    CriticalCVE-2026-38431

    Frappe ERPNext: Template Injection

    		9.8
    HighCVE-2026-65822

    ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

    		7.6
    HighCVE-2026-94113

    Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

    		6.5
    CriticalCVE-2025-67289

    Frappe: Unrestricted File Upload

    also in 1 other product

    		9.6
    HighCVE-2026-109673

    Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names

    		7.3
    HighCVE-2026-109671

    Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages

    		7.3
    HighCVE-2026-109653

    Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover

    		7.3
    HighCVE-2026-109612

    Frappe ERPNext before 15.120.0 Stored XSS via Report View

    		7.3
    HighCVE-2026-109604

    ERPNext before 15.112.0 Stored XSS via Tool View Record Names

    		7.3
    HighCVE-2026-72910

    ERPNext: Unauthorised modification of master data due to missing validation

    		7.1

    All vulnerabilities in search

    News

    All products by Frappe