ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ERPNext 15.89.0 and earlier versions, which stems from the presence of server-side template injection in the getcontracttemplate method, which could lead to server-side code...

EUVD-2019-11058

Malware in sbrugna...

EUVD-2019-11055

Malware in sbrugna...

EUVD-2019-11065

Malware in sbrugna...

EUVD-2018-12636

Malware in sbrugna...

EUVD-2019-11064

Malware in sbrugna...

EUVD-2025-13459

Malicious code in bioql PyPI...

EUVD-2022-28165

Malicious code in bioql PyPI...

EUVD-2022-28166

Malicious code in bioql PyPI...

EUVD-2022-28167

Malicious code in bioql PyPI...

CVE-2025-52042

In Frappe ERPNext 15.57.5, the function getrfqcontainingsupplier at erpnext/buying/doctype/requestforquotation/requestforquotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter...

CVE-2025-52039

In Frappe ERPNext 15.57.5, the function getmaterialrequestsbasedonsupplier at erpnext/stock/doctype/materialrequest/materialrequest.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter...

CVE-2025-52041

In Frappe ERPNext 15.57.5, the function getstockbalancefor at erpnext/stock/doctype/stockreconciliation/stockreconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventorydimensionsdict parameter...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a SQL injection vulnerability that stems from the lack of validation of the txt parameter of the getrfqcontainingsupplier function against externally entered SQL statements. An attacker can...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ERPNext version 15.57.5, which stems from an unvalidated txt parameter that could lead to an SQL injection attack...

CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

CVE-2025-52047

CVE-2025-52047 affects Frappe ErpNext v15.57.5, where the function get_income_account() in erpnext/controllers/queries.py is vulnerable to SQL Injection via the filters.disabled parameter, potentially enabling an attacker to extract data from the database. The issue is confirmed by multiple conne...

PT-2025-39990

Name of the Vulnerable Software and Affected Versions Frappe ErpNext version 15.57.5 Description The get income account function at erpnext/controllers/queries.py is susceptible to SQL Injection. An attacker can inject a SQL query into the filters.disabled parameter, potentially allowing extracti...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the get_stock_balance() function in erpnext/stock/utils.py is vulnerable to SQL Injection via the inventory_dimensions_dict parameter, potentially allowing an attacker to extract data from databases. Connected documents confirm the affected software, vulnerable compone...

ERPNext Cross-Site Request Forgery Vulnerability

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a cross-site request forgery vulnerability that can be exploited by attackers to cause unauthorized operations...