CVE-2025-52049

In Frappe ErpNext v15.57.5, the function gettimesheetdetailrate at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter...

CVE-2025-52049

In Frappe ErpNext v15.57.5, the function gettimesheetdetailrate at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter...

CVE-2025-52049

In Frappe ErpNext v15.57.5, the function gettimesheetdetailrate at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter...

CVE-2025-52047: Improper Neutralization of Special Elements used in an SQL Command

In Frappe ErpNext v15.57.5, the function getincomeaccount at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter...

CVE-2025-52047

In Frappe ErpNext v15.57.5, the function getincomeaccount at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter...

PT-2025-39989

Name of the Vulnerable Software and Affected Versions Frappe ERPNext version 15.57.5 Description The import coa function located at erpnext/accounts/doctype/chart of accounts importer/chart of accounts importer.py is susceptible to SQL injection. An attacker can inject a SQL query through the...

PT-2025-39991

Name of the Vulnerable Software and Affected Versions Frappe ErpNext version 15.57.5 Description The get timesheet detail rate function located at erpnext/projects/doctype/timesheet/timesheet.py is susceptible to SQL Injection. This allows an attacker to extract information from databases by...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the filters.disabled parameter of the getincomeaccount function. An attacker can...

CVE-2025-52050

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

CVE-2025-52050

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

CVE-2025-52049: Improper Neutralization of Special Elements used in an SQL Command

In Frappe ErpNext v15.57.5, the function gettimesheetdetailrate at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter...

CVE-2025-52047

In Frappe ErpNext v15.57.5, the function getincomeaccount at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter...

CVE-2025-52050: Improper Neutralization of Special Elements used in an SQL Command

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

CVE-2025-52043: Improper Neutralization of Special Elements used in an SQL Command

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

CVE-2025-52043

Frappe ERPNext version 15.57.5 is vulnerable to SQL injection within the import_coa() function located at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py. The root cause is a lack of validation for the company parameter, which allows an attacker to inject malicio...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a SQL injection vulnerability that stems from the lack of validation of the importcoa function's company parameter against externally entered SQL statements. An attacker can exploit this...

CVE-2025-52047

Frappe ErpNext version 15.57.5 is vulnerable to a SQL Injection flaw in the get_income_account() function located at erpnext/controllers/queries.py. The root cause is a lack of validation for externally entered SQL statements within the filters.disabled parameter. An attacker can exploit this by ...

CVE-2025-52049

Frappe ErpNext v15.57.5 is vulnerable to SQL Injection within the get_timesheet_detail_rate() function located at erpnext/projects/doctype/timesheet/timesheet.py. This flaw stems from the use of unvalidated timelog parameters, which allows an attacker to inject malicious SQL queries to extract in...