ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0.
References
| Link | Resource |
|---|---|
| https://github.com/frappe/erpnext/security/advisories/GHSA-6fm9-g88m-hxr7 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
14 May 2026, 20:01
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* | |
| References | () https://github.com/frappe/erpnext/security/advisories/GHSA-6fm9-g88m-hxr7 - Vendor Advisory | |
| First Time |
Frappe
Frappe erpnext |
13 May 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-13 22:16
Updated : 2026-05-14 20:01
NVD link : CVE-2026-44446
Mitre link : CVE-2026-44446
CVE.ORG link : CVE-2026-44446
JSON object : View
Products Affected
frappe
- erpnext
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')