SQL Injection Vulnerability in ERPNext by Frappe
CVE-2026-44446

8.8HIGH

Key Information:

Vendor

Frappe

Status
Erpnext
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44446?

ERPNext, an open source Enterprise Resource Planning solution, has a vulnerability that affects certain prior versions, allowing SQL injection through specially crafted requests. This flaw could enable an attacker to retrieve sensitive data, compromising the confidentiality of information stored within the application. Fortunately, this issue has been mitigated in versions 15.104.3 and 16.14.0, which address the security concern effectively.

Affected Version(s)

erpnext >= 16.0.0-beta.1, < 16.14.0 < 16.0.0-beta.1, 16.14.0

erpnext < 15.104.3 < 15.104.3

References

https://github.com/frappe/erpnext/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.