CVE-2026-44441

4.3 Moyenne

Publiée le 14/05/2026 à 00:16 · Modifiée le 17/06/2026 à 12:50 · Analysée par le NVD · Source : security-advisories@github.com

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoint, which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 15.106.0 and 16.16.0.

Traduire en français

Produits concernés

frappe erpnext

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.0 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N`
3.1	4.3 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/frappe/erpnext/security/advisories/GHSA-m4m4-j2m2-7fcw Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories