CVE-2026-44441: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an…

PriorityP423medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

0.16%

5.7th percentile

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoint, which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 15.106.0 and 16.16.0.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
frappe	erpnext	< 15.106.0	15.106.0
frappe	erpnext	—	—
frappe	erpnext	>= 16.0.0 < 16.16.0	16.16.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.