Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive configuration files. This vulnerability is fixed in 15.104.3 and 16.12.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-44445 XML External Entity Injection in ERPNext EDI Module Before 15.104.3 and 16.12.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44445
Post summary
A newly disclosed XML External Entity Injection vulnerability (CVE-2026-44445) affects the ERPNext EDI Module up to versions 15.104.3 and 16.12.0, with details available via a vulnerability database link.
CVE-2026-44445 ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vul… https://www.cve.org/CVERecord?id=CVE-2026-44445
Post summary
CVE‑2026‑44445 alerts to an XXE restriction flaw in ERPNext before versions 15.104.3/16.12.0, but no PoC, exploit, or patch details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | frappe | erpnext | - | - | - |