ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the filters.disabled parameter of the getincomeaccount function. An attacker can...

CVE-2025-52047

CVE-2025-52047 affects Frappe ErpNext v15.57.5, where the function get_income_account() in erpnext/controllers/queries.py is vulnerable to SQL Injection via the filters.disabled parameter, potentially enabling an attacker to extract data from the database. The issue is confirmed by multiple conne...

CVE-2025-52050

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

CVE-2025-52047

In Frappe ErpNext v15.57.5, the function getincomeaccount at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

PT-2025-37984

Name of the Vulnerable Software and Affected Versions: Frappe ERPNext version 15.57.5 Description: Frappe ERPNext version 15.57.5 contains a SQL injection issue in the get stock balance function located at erpnext/stock/utils.py. An attacker can inject a SQL query into the inventory dimensions di...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ERPNext version v15.57.5 that stems from insufficient validation of the inventorydimensionsdict parameter, which could lead to an SQL injection attack...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the get_stock_balance() function in erpnext/stock/utils.py is vulnerable to SQL Injection via the inventory_dimensions_dict parameter, potentially allowing an attacker to extract data from databases. Connected documents confirm the affected software, vulnerable compone...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

ERPNext SQL注入漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A SQL injection vulnerability exists in ERPNext versions prior to 14.89.2 and 15.0.0 through 15.75.1, which stems from insufficient parameter validation and could lead to SQL injection attacks...

CVE-2022-28598

Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users...

CVE-2020-6145

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

ERPNext Cross-Site Request Forgery Vulnerability

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a cross-site request forgery vulnerability that can be exploited by attackers to cause unauthorized operations...

CVE-2025-28062

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...

📄 ERPNext 14.82.1 Cross Site Request Forgery

ERPNext versions 14.82.1 and below suffer from a cross site request forgery vulnerability. Exploit Title: ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery CSRF Google Dork: inurl:"/api/method/frappe" Date: 2025-04-29 Exploit Author: Ahmed Thaiban Thvt0ne Vendor Homepage:...

CVE-2025-28062

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...

PT-2025-19726 · Erpnext · Erpnext

Name of the Vulnerable Software and Affected Versions: ERPNEXT versions 14.74.3 through 14.82.1 Description: A Cross-Site Request Forgery CSRF vulnerability was discovered, allowing an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to...

CVE-2025-28062

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...