CVE-2026-109663 | Frappe ERPNext up to 15.112.x/16.21.x sql injection

October 13, 2026 Yanac

A vulnerability was found in Frappe ERPNext up to 15.112.x/16.21.x. It has been classified as critical. The affected element is an unknown function. The manipulation leads to sql injection.

This vulnerability is documented as CVE-2026-109663. The attack can be initiated remotely. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More