CVE-2026-109608
8.8 HIGHpublic exploit availablePublished 2026-10-12 · Updated 2026-10-15
AI risk analysis
- Summary
- An SQL injection vulnerability in Frappe ERPNext allows authenticated users to access sensitive data from other users and escalate privileges. This affects versions before 15.121.0 and 16.x before 16.34.0.
- Exploitability
- The vulnerability is easily exploitable by any authenticated user with minimal prerequisites, requiring only valid credentials to send crafted requests that bypass input validation.
- Blast radius
- The impact could be significant across an organization as attackers can read sensitive user data and potentially escalate to privileged accounts, affecting multiple users' information and system access.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to ERPNext version 15.121.0 or 16.34.0 to remediate the SQL injection vulnerability.
sql-injectionprivilege-escalationweb-application
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2025-45871PoC
- HIGHCVE-2026-39771
- HIGHCVE-2026-42722
- HIGHCVE-2026-63154PoC
- HIGHCVE-2026-66628
- HIGHCVE-2026-70266
- HIGHCVE-2026-88075
- CRITICALCVE-2026-97668
Related by shared AI tags and CWE weakness class. Browse the full archive.