CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

CVE-2025-52043

Frappe ERPNext v15.57.5 is vulnerable to SQL injection in the import_coa() function located at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py. The root cause is a lack of validation for the company parameter, which allows an attacker to inject malicious SQL quer...