Export limit exceeded: 407675 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407675 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109656 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role. | ||||
| CVE-2026-109655 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role. | ||||
| CVE-2026-109651 | 1 Frappe | 1 Erpnext | 2026-10-12 | 4.3 Medium |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment's network. | ||||
| CVE-2026-109650 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits. | ||||
| CVE-2026-109646 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database. | ||||
| CVE-2026-109645 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions. | ||||
| CVE-2026-109641 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature. | ||||
| CVE-2026-109640 | 1 Frappe | 1 Erpnext | 2026-10-12 | 8.1 High |
| Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data. | ||||
| CVE-2026-109636 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role. | ||||
| CVE-2026-109635 | 1 Frappe | 1 Erpnext | 2026-10-12 | 4.3 Medium |
| Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own. | ||||
| CVE-2026-109631 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database. | ||||
| CVE-2026-109630 | 1 Frappe | 1 Erpnext | 2026-10-12 | 4.3 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits. | ||||
| CVE-2026-109626 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database. | ||||
| CVE-2026-109625 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role. | ||||
| CVE-2026-109621 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role. | ||||
| CVE-2026-109617 | 1 Frappe | 1 Erpnext | 2026-10-12 | 7.1 High |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions. | ||||
| CVE-2026-109614 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view. | ||||
| CVE-2026-109613 | 1 Frappe | 1 Erpnext | 2026-10-12 | 7.1 High |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions. | ||||
| CVE-2026-109612 | 1 Frappe | 1 Erpnext | 2026-10-12 | 7.3 High |
| Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report. | ||||
| CVE-2026-109608 | 1 Frappe | 1 Erpnext | 2026-10-12 | 8.8 High |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account. | ||||