PT-2026-40824 · Frappe · Erpnext

CVE-2026-44447 · Published 2026-05-13 · Updated 2026-05-15

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 16.9.0

Description Certain endpoints are susceptible to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution, allowing an attacker to extract sensitive information via specially crafted requests.

Recommendations Update to version 16.9.0.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44447

GHSA-Q65V-FM9P-9VH3

Affected Products

Erpnext

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44447.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-44447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44447 · Security Note
• https://github.com/frappe/erpnext/security/advisories/GHSA-q65v-fm9p-9vh3 · Note
• https://t.me/CVEtracker/53723 · Telegram Post
• https://twitter.com/CyStackSecurity/status/2055203400367947980 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054786073025298541 · Twitter Post