CVE-2026-109648 | Frappe ERPNext up to 15.105.x/16.15.x sql injection

October 13, 2026 Yanac

A vulnerability classified as critical was found in Frappe ERPNext up to 15.105.x/16.15.x. This impacts an unknown function. Executing a manipulation can lead to sql injection.

This vulnerability is tracked as CVE-2026-109648. The attack can be launched remotely. No exploit exists.

Upgrading the affected component is advised.VulDB Recent EntriesRead More