CVE-2025-52049

In Frappe ErpNext v15.57.5, the function gettimesheetdetailrate at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter...

CVE-2025-52047

Frappe ErpNext version 15.57.5 is vulnerable to a SQL Injection flaw in the get_income_account() function located at erpnext/controllers/queries.py. The root cause is a lack of validation for externally entered SQL statements within the filters.disabled parameter. An attacker can exploit this by ...

CVE-2025-52049

Frappe ErpNext v15.57.5 is vulnerable to SQL Injection within the get_timesheet_detail_rate() function located at erpnext/projects/doctype/timesheet/timesheet.py. This flaw stems from the use of unvalidated timelog parameters, which allows an attacker to inject malicious SQL queries to extract in...

CVE-2025-52050

Frappe ERPNext version 15.57.5 is vulnerable to SQL Injection within the get_loyalty_program_details_with_points() function located at erpnext/accounts/doctype/loyalty_program/loyalty_program.py. The root cause is insufficient validation of the expiry_date parameter. An attacker can exploit this ...

PT-2025-39992

Name of the Vulnerable Software and Affected Versions Frappe ERPNext version 15.57.5 Description The get loyalty program details with points function located at erpnext/accounts/doctype/loyalty program/loyalty program.py is susceptible to SQL Injection. An attacker can inject a SQL query into the...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ErpNext version v15.57.5, which stems from unvalidated timelog parameters and could lead to SQL injection attacks...

PT-2025-39990

Name of the Vulnerable Software and Affected Versions Frappe ErpNext version 15.57.5 Description The get income account function at erpnext/controllers/queries.py is susceptible to SQL Injection. An attacker can inject a SQL query into the filters.disabled parameter, potentially allowing extracti...

CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ERPNext version v15.57.5 that stems from insufficient validation of the inventorydimensionsdict parameter, which could lead to an SQL injection attack...

PT-2025-37984

Name of the Vulnerable Software and Affected Versions: Frappe ERPNext version 15.57.5 Description: Frappe ERPNext version 15.57.5 contains a SQL injection issue in the get stock balance function located at erpnext/stock/utils.py. An attacker can inject a SQL query into the inventory dimensions di...

CVE-2025-52044

In Frappe ERPNext v15.57.5 , the get_stock_balance() function located at erpnext/stock/utils.py is vulnerable to SQL Injection . The root cause is the insufficient validation of the inventory_dimensions_dict parameter, which allows an attacker to inject SQL queries and potentially extract all inf...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

CVE-2025-52044: Improper Neutralization of Special Elements used in an SQL Command

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

CVE-2025-52044

In Frappe ERPNext v15.57.5, the function getstockbalance at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventorydimensionsdict parameter...

ERPNext SQL注入漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A SQL injection vulnerability exists in ERPNext versions prior to 14.89.2 and 15.0.0 through 15.75.1, which stems from insufficient parameter validation and could lead to SQL injection attacks...

CVE-2022-28598

Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users...

CVE-2020-6145

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...