erpnext
v16.55.0Free and Open Source Enterprise Resource Planning (ERP)
- Maintenance
- Active5899 commits in 3 months · bus factor 6
- License
- GPL-3.0Copyleft · OSI-approved
- Security
- 30 advisories6 high, 24 medium · Scorecard 6.0/10
- Supported versions
- No scheduleendoflife.date does not track this project
41.3k stars · 13.5k forks · 1.9k open issues · last release 3 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 6 high, 24 medium. Check the patched version against the one you run.
- highGHSA-cc74-rc2g-p7hwNov 6, 2026Possibility of SQL injection in the Selling and Buying modules due to missing validation
- Affected
- < 15.121.6; < 16.37.0
- Patched in
- 15.121.6; 16.37.0
- mediumGHSA-ggr3-x356-w97hNov 6, 2026Unauthorised modification of bulk transaction logs in the Utilities module due to missing validation
- Affected
- < 15.121.0; < 16.34.0
- Patched in
- 15.121.0; 16.34.0
- mediumGHSA-6937-44rq-87xrNov 6, 2026Unauthorised access to Timesheet billing data in the Projects module due to missing validation
- Affected
- < 15.121.0; < 16.34.0
- Patched in
- 15.121.0; 16.34.0
- mediumGHSA-chqg-f85c-wxr7Nov 6, 2026Unauthorised access to subscription plan details of invoices in the Accounts module due to missing validation
- Affected
- < 15.122.0; < 16.34.0
- Patched in
- 15.122.0; 16.34.0
- mediumGHSA-45p2-2pp7-f8w2Nov 6, 2026Unauthorised access to Payment Entries outside the user's permissions in the Accounts module due to missing validation
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- mediumGHSA-grg4-q5gc-4g4xNov 6, 2026Unauthorised access to asset depreciation data of other companies in the Assets module due to missing validation
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- mediumGHSA-9jrr-9pr6-7mv8Nov 6, 2026Exposure of imported supplier e-invoices as public files in the Regional module
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- mediumGHSA-gj65-6744-3fv4Nov 6, 2026Stored cross-site scripting in CRM notes due to missing validation
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- highGHSA-877j-rg2w-v649Nov 6, 2026Unauthorised access to customer documents through print and portal views due to missing validation
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- mediumGHSA-hfj8-f2p9-f2xfNov 6, 2026Unauthorised access to Sales Order items in the Selling module due to missing validation
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- mediumGHSA-fjj8-qq2m-h96wNov 6, 2026Unauthorised reposting of accounting entries in the Accounts module due to missing validation
- Affected
- < 15.122.0; < 16.50.0
- Patched in
- 15.122.0; 16.50.0
- highGHSA-29xj-69vf-fmmhNov 6, 2026Unauthorised access to complete selling documents and RFQs in the customer and supplier portals due to missing validation
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- mediumGHSA-v93q-wwv7-hm54Nov 6, 2026Unauthorised access to Project costing in the customer portal due to missing validation
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- mediumGHSA-8mhv-pfp8-m66qNov 6, 2026Unauthorised access to party addresses through Tax Rule in the Accounts module due to missing validation
- Affected
- < 15.122.0; < 16.50.0
- Patched in
- 15.122.0; 16.50.0
- mediumGHSA-rcpm-332h-mj8fNov 6, 2026Unauthorised access to inter-company invoice and order items in the Accounts module due to missing validation
- Affected
- < 15.121.4; < 16.36.0
- Patched in
- 15.121.4; 16.36.0
- mediumGHSA-qrv3-vxh2-xx3gNov 6, 2026Unauthorised access to Bank Transaction amounts in the Accounts module due to missing validation
- Affected
- < 15.122.0; < 16.50.0
- Patched in
- 15.122.0; 16.50.0
- highGHSA-64h3-xccr-q5jrNov 6, 2026Unauthorised access to source documents through Payment Requests in the Accounts module due to missing validation
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- mediumGHSA-crxr-qmq5-mm3qNov 6, 2026Unauthorised access to Bank Transactions of other companies in the Accounts module due to missing validation
- Affected
- < 15.122.0; < 16.50.0
- Patched in
- 15.122.0; 16.50.0
- mediumGHSA-gqm4-wpw8-qrc9Nov 6, 2026Unauthorised access to Serial No and Batch ledgers in the Stock module due to missing validation
- Affected
- < 15.122.0; < 16.50.0
- Patched in
- 15.122.0; 16.50.0
- highGHSA-26pv-59j4-p5m7Nov 6, 2026Unauthorised access to e-invoice files in the Regional module due to missing validation
- Affected
- < 15.121.4; < 16.36.0
- Patched in
- 15.121.4; 16.36.0
- highGHSA-h7xr-2wpr-7444Nov 6, 2026Unauthorised access to Item master data in the Stock module due to missing validation
- Affected
- < 15.121.4; < 16.36.0
- Patched in
- 15.121.4; 16.36.0
- mediumGHSA-7455-jhmp-j2h2Nov 6, 2026Unauthorised access to Activity Cost rates in the Projects module due to missing validation
- Affected
- < 15.122.0; < 16.50.0
- Patched in
- 15.122.0; 16.50.0
- mediumGHSA-98p6-cv49-h8c3Nov 6, 2026Unauthorised access to item valuation and average purchase cost in the Stock module due to missing validation
- Affected
- < 15.124.2; < 16.53.0
- Patched in
- 15.124.2; 16.53.0
- mediumGHSA-6xf4-gr7h-2h57Nov 6, 2026Unauthorised access to stock value in Stock dashboards due to missing validation
- Affected
- < 16.50.0
- Patched in
- 16.50.0
- mediumGHSA-qr6v-w65q-v497Nov 6, 2026Unauthorised access to Issues in the customer portal due to missing validation
- Affected
- < 15.124.0; < 16.52.0
- Patched in
- 15.124.0; 16.52.0
- mediumGHSA-xmw8-rg38-x88jNov 6, 2026Unauthorised access to supplier portal records through a party identity mix-up due to missing validation
- Affected
- < 15.122.0; < 16.50.0
- Patched in
- 15.122.0; 16.50.0
- mediumGHSA-c3mc-qh7f-hwcvNov 6, 2026Unauthorised stopping and closing of Work Orders of other companies in the Manufacturing module due to missing validation
- Affected
- < 15.121.4; < 16.36.0
- Patched in
- 15.121.4; 16.36.0
- mediumGHSA-mmcf-jq27-crrpNov 6, 2026Unauthorised closing of Purchase Orders of other companies in the Buying module due to missing validation
- Affected
- < 15.121.4; < 16.36.0
- Patched in
- 15.121.4; 16.36.0
- mediumGHSA-jfr9-q72f-854xNov 6, 2026Unauthorised closing of Sales Orders of other companies in the Selling module due to missing validation
- Affected
- < 15.121.4; < 16.36.0
- Patched in
- 15.121.4; 16.36.0
- mediumGHSA-4mg4-7qq3-phxcNov 6, 2026Unauthorised creation of Serial No and Batch records in the Stock module due to missing validation
- Affected
- < 15.122.0; < 16.50.0
- Patched in
- 15.122.0; 16.50.0