PT-2026-111076

CVE-2026-109663

Published

2026-10-12

Updated

2026-10-12

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.113.0 Frappe ERPNext versions 16.x prior to 16.22.0

Description Missing input validation in certain endpoints allows authenticated remote attackers to perform SQL injection. By sending specially crafted requests, an attacker can manipulate database queries to extract sensitive information from the database. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations Update to version 15.113.0 or later. Update to version 16.22.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ankush

Muztahidultanim

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')