CVE-2026-109663

Publié : 12 octobre 2026

Modifié : 12 octobre 2026

Score CVSS

6.5

MEDIUM

Description détaillée

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://github.com/frappe/erpnext/security/advisories/GHSA-gwfr-5r8f-rwg4 https://www.vulncheck.com/advisories/frappe-erpnext-before-15.113.0-sql-injection-via-unvalidated-endpoint-parameters

Dernières Vulnérabilités

CVE-2026-96119

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

VOIR DÉTAILS

CVE-2026-93886

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

VOIR DÉTAILS

CVE-2026-81858

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

VOIR DÉTAILS