CVE-2026-109646

MEDIUM · 6.5 CVSS Gepubliceerd: 13-10-2026 CWE-89

Beschrijving

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.

References

github.com
www.vulncheck.com