PT-2026-40824 · Frappe · Erpnext

Published 2026-05-13 · Updated 2026-05-15 · CVE-2026-44447

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 16.9.0

Description Certain endpoints are susceptible to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution, allowing an attacker to extract sensitive information via specially crafted requests.

Recommendations Update to version 16.9.0.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44447

Affected Products

Erpnext

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-44447 · Security Note
• https://github.com/frappe/erpnext/security/advisories/GHSA-q65v-fm9p-9vh3 · Note
• https://twitter.com/VulmonFeeds/status/2054786073025298541 · Twitter Post
• https://t.me/CVEtracker/53723 · Telegram Post
• https://twitter.com/CyStackSecurity/status/2055203400367947980 · Twitter Post