CVE-2025-6034

creationtimestamp| type| source ---|---|--- 2025-09-30 20:03:04+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3m23cyponwi23...

CVE-2025-61733

creationtimestamp| type| source ---|---|--- 2025-09-30 16:17:35+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m22wfji3ld23 2025-10-02 12:36:27+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115304601143297105 2025-10-06 13:48:27+00:00| seen|...

CVE-2025-52050

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

CVE-2024-13150

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Fayton Software and Consulting Services fayton.Pro ERP allows SQL Injection.This issue affects fayton.Pro ERP: through 20250929...

CVE-2025-41095

creationtimestamp| type| source ---|---|--- 2025-09-30 11:57:25+00:00| seen| Telegram/IByZ3gpMuCVXQmWNcnNVrQKVD-Vfj4Bk0YGBnSQIjdPTA...

CVE-2025-7063

creationtimestamp| type| source ---|---|--- 2025-09-30 11:00:34+00:00| seen| Telegram/IAdbnHTJCfUUBph1zMCi4hRMAorF36HEK9DqS8CeaOIOuAI 2025-09-30 11:00:35+00:00| seen| Telegram/ctVXQJnmhN5CCA-5ZoC6w5XxXgpdy4w1DFd74cFdBVCMNs 2025-09-30 11:00:36+00:00| seen|...

CVE-2025-0016

creationtimestamp| type| source ---|---|--- 2025-09-30 08:28:35+00:00| seen| https://gist.github.com/Darkcrai86/c13969010103b69e0105cf1f0b7454db...

CVE-2025-10191

creationtimestamp| type| source ---|---|--- 2025-09-30 03:58:47+00:00| seen| Telegram/llPKRqSCKnA4WaL4oF-SkHBZh3Do9rJXC1vVbTWYJjrAbP8...

CVE-2025-57529

creationtimestamp| type| source ---|---|--- 2025-09-30 02:57:56+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/53602 2025-10-18 09:50:45+00:00| seen| https://t.me/NinjaSec/424 2026-02-04 16:57:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2duahplb2r...

CVE-2025-52050

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

CVE-2025-52050

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

CVE-2025-52050

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

Frappe Technologies – Frappe security vulnerabilities

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe version 15.57.5, which stems from insufficient validation of the expirydate parameter and...

PT-2025-39992

Name of the Vulnerable Software and Affected Versions Frappe ERPNext version 15.57.5 Description The get loyalty program details with points function located at erpnext/accounts/doctype/loyalty program/loyalty program.py is susceptible to SQL Injection. An attacker can inject a SQL query into the...

CVE-2025-52050

Frappe ERPNext version 15.57.5 is vulnerable to SQL Injection within the get_loyalty_program_details_with_points() function located at erpnext/accounts/doctype/loyalty_program/loyalty_program.py. The root cause is insufficient validation of the expiry_date parameter. An attacker can exploit this ...

CVE-2025-35030

Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08...

CVE-2025-35031

Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08...

CVE-2025-35032

Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08...

CVE-2025-35034

Medical Informatics Engineering Enterprise Health is affected by a reflected cross-site scripting vulnerability in the portlet_user_id URL parameter. A remote, unauthenticated attacker can craft a URL to execute arbitrary JavaScript in a victim’s browser. The issue is fixed as of 2025-03-14. Acco...

CVE-2025-35031

Medical Informatics Engineering Enterprise Health is affected by CVE-2025-35031, where the software includes the user’s current session token in debug output. This enables an attacker to impersonate the user if the token is exfiltrated (e.g., via the user sending debug output). The issue is fixed...