Export limit exceeded: 409386 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409386 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409386 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109671 | 1 Frappe | 1 Erpnext | 2026-10-12 | 7.3 High |
| Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover. | ||||
| CVE-2026-109670 | 1 Frappe | 1 Erpnext | 2026-10-12 | 5.4 Medium |
| Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page. | ||||
| CVE-2026-109666 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits. | ||||
| CVE-2026-109665 | 1 Frappe | 1 Erpnext | 2026-10-12 | 4.3 Medium |
| Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role. | ||||
| CVE-2026-109660 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits. | ||||
| CVE-2026-109655 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role. | ||||
| CVE-2026-109650 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits. | ||||
| CVE-2026-109645 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions. | ||||
| CVE-2026-109640 | 1 Frappe | 1 Erpnext | 2026-10-12 | 8.1 High |
| Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data. | ||||
| CVE-2026-109635 | 1 Frappe | 1 Erpnext | 2026-10-12 | 4.3 Medium |
| Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own. | ||||
| CVE-2026-109634 | 1 Frappe | 1 Erpnext | 2026-10-12 | 4.9 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database. | ||||
| CVE-2026-109630 | 1 Frappe | 1 Erpnext | 2026-10-12 | 4.3 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits. | ||||
| CVE-2026-109629 | 1 Frappe | 1 Erpnext | 2026-10-12 | 4.3 Medium |
| Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lists and message content to send attacker-controlled messages carrying the organisation's sending identity. | ||||
| CVE-2026-109625 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role. | ||||
| CVE-2026-109624 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits. | ||||
| CVE-2026-109617 | 1 Frappe | 1 Erpnext | 2026-10-12 | 7.1 High |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions. | ||||
| CVE-2026-109612 | 1 Frappe | 1 Erpnext | 2026-10-12 | 7.3 High |
| Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report. | ||||
| CVE-2026-109604 | 1 Frappe | 1 Erpnext | 2026-10-12 | 7.3 High |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool. | ||||
| CVE-2026-109599 | 1 Frappe | 1 Frappe | 2026-10-12 | 4.3 Medium |
| Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits. | ||||
| CVE-2026-109574 | 1 Gohugo | 1 Hugo | 2026-10-12 | 5.5 Medium |
| Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS. | ||||