CVE-2025-52042

Frappe ERPNext version 15.57.5 is vulnerable to SQL Injection within the get_rfq_containing_supplier() function located at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py. The root cause is a lack of validation for the txt parameter , which allows an attacker to inject malic...