Medium
Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
Type: advisorySource: Official CVE List
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitr…
Products: ERPNextCVEs: CVE-2026-96672