Frappe Erpnext vulnerabilities

CVE-2025-66435 [MEDIUM] CWE-94 CVE-2025-66435: An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (contract_terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals

CVE-2025-66436 [MEDIUM] CWE-94 CVE-2025-66436: An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such

CVE-2019-20511 [MEDIUM] CWE-79 CVE-2019-20511: ERPNext 11.1.47 allows blog?blog_category= Frame Injection. ERPNext 11.1.47 allows blog?blog_category= Frame Injection.

CVE-2025-65923 [MEDIUM] CWE-79 CVE-2025-65923: A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. An attacker can embed malicious JavaScript code into a CSV field, which is then stored in the database and executed whenever the affected record is viewed by a user within the ERPNext we

CVE-2026-38432 [MEDIUM] CWE-79 CVE-2026-38432: ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engin ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied.

CVE-2022-23055 [MEDIUM] CWE-862 CVE-2022-23055: In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the ch In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of

CVE-2025-56379 [MEDIUM] CWE-79 CVE-2025-56379: A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allow A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field.

CVE-2022-23057 [MEDIUM] CWE-79 CVE-2022-23057: In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to us In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.

CVE-2026-42839 [MEDIUM] CWE-79 CVE-2026-42839: An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScrip An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item and trigger unescaped rendering in the Point of Sale (POS) cart interface for every operator who adds that item to a transaction.This issue affects ERPNext: 16.16.0.

CVE-2019-20521 [MEDIUM] CWE-79 CVE-2019-20521: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI. ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.

CVE-2019-20520 [MEDIUM] CWE-79 CVE-2019-20520: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI. ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.

CVE-2026-44441 [MEDIUM] CWE-918 CVE-2026-44441: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoint, which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 15.106.0 and 16.16.0.

CVE-2019-20516 [MEDIUM] CWE-79 CVE-2019-20516: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.

CVE-2019-20514 [MEDIUM] CWE-79 CVE-2019-20514: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.

CVE-2019-20519 [MEDIUM] CWE-79 CVE-2019-20519: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafte ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.

CVE-2019-20517 [MEDIUM] CWE-79 CVE-2019-20517: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.

CVE-2019-20518 [MEDIUM] CWE-79 CVE-2019-20518: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI. ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.

CVE-2019-20515 [MEDIUM] CWE-79 CVE-2019-20515: ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.

CVE-2025-65924 [MEDIUM] CWE-80 CVE-2025-65924: ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files ge

CVE-2022-23058 [LOW] CWE-79 CVE-2022-23058: ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privi ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.