# Frappe Erpnext


- [CVE-2026-44442](https://insights.sbomify.com/CVE-2026-44442/): ERPNext: Unauthorised Document modification due to missing validation (critical 9.9)
- [CVE-2026-38431](https://insights.sbomify.com/CVE-2026-38431/): Code injection in n/a (critical 9.8)
- [CVE-2025-66438](https://insights.sbomify.com/CVE-2025-66438/): Code injection in n/a (critical 9.8)
- [CVE-2025-66439](https://insights.sbomify.com/CVE-2025-66439/): SQL injection in n/a (critical 9.8)
- [CVE-2025-66440](https://insights.sbomify.com/CVE-2025-66440/): SQL injection in n/a (critical 9.8)
- [CVE-2025-67289](https://insights.sbomify.com/CVE-2025-67289/): File upload in n/a (critical 9.6)
- [CVE-2026-27471](https://insights.sbomify.com/CVE-2026-27471/): ERP: Document access through endpoints due to missing validation (critical 9.3)
- [CVE-2026-31017](https://insights.sbomify.com/CVE-2026-31017/): Server-side request forgery in n/a (critical 9.1)
- [CVE-2025-65267](https://insights.sbomify.com/CVE-2025-65267/): Cross-site scripting in n/a (critical 9.0)
- [CVE-2026-44446](https://insights.sbomify.com/CVE-2026-44446/): ERPNext: Possibility of SQL Injection due to missing validation (high 8.8)
- [CVE-2026-44447](https://insights.sbomify.com/CVE-2026-44447/): ERPNext: Possibility of SQL Injection due to missing validation (high 8.8)
- [CVE-2025-66434](https://insights.sbomify.com/CVE-2025-66434/): Code injection in n/a (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/frappe/erpnext/