PT-2026-40823 · Frappe · Erpnext

Patrickt2017 + 1 · Published 2026-05-13 · Updated 2026-05-15 · CVE-2026-44446

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.104.3 ERPNext versions prior to 16.14.0

Description Certain endpoints are susceptible to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution, allowing an attacker to extract sensitive information via specially crafted requests.

Recommendations Update to version 15.104.3. Update to version 16.14.0.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44446

Affected Products

Erpnext

References · 7

• https://github.com/frappe/erpnext/security/advisories/GHSA-6fm9-g88m-hxr7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44446 · Security Note
• https://reddit.com/r/pwnhub/comments/1tcxvsv/erpnext_sql_injection_cve202644446 · Reddit Post
• https://t.me/CVEtracker/53722 · Telegram Post
• https://twitter.com/CyStackSecurity/status/2055203400367947980 · Twitter Post
• https://twitter.com/CVEnew/status/2054709194046255430 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054791191850336316 · Twitter Post