CVE-2026-109638 | Frappe ERPNext up to 15.109.x/16.20.x sql injection

October 13, 2026 Yanac

A vulnerability classified as critical was found in Frappe ERPNext up to 15.109.x/16.20.x. The affected element is an unknown function. Such manipulation leads to sql injection.

This vulnerability is listed as CVE-2026-109638. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is advised.VulDB Recent EntriesRead More