CVE-2025-66440

An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments at erpnext/accounts/doctype/paymententry/paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the...

CVE-2025-66440

Frappe ERPNext versions through 15.89.0 are vulnerable to SQL Injection in the get_outstanding_reference_documents() function located at erpnext/accounts/doctype/payment_entry/payment_entry.py. The root cause is the direct interpolation of the to_posting_date parameter into a database query witho...

CVE-2025-66440

An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments at erpnext/accounts/doctype/paymententry/paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the...

CVE-2025-66439

Frappe ERPNext versions through 15.89.0 are vulnerable to an SQL Injection flaw in the get_outstanding_reference_documents() function located at erpnext.accounts.doctype.payment_entry.payment_entry.py. The root cause is the direct interpolation of the from_posting_date parameter into a database q...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ERPNext 15.89.0 and earlier versions, which stems from improper handling of the topostingdate parameter in the getoutstandingreferencedocuments function, which could lead to a SQ...