CVE-2025-66440

An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments at erpnext/accounts/doctype/paymententry/paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the...

CVE-2025-66440

CVE-2025-66440 affects Frappe ERPNext up to version 15.89.0. The issue occurs in get_outstanding_reference_documents() within payment_entry.py, where the to_posting_date parameter is directly interpolated into a SQL query without sanitization or parameter binding, enabling SQL injection. The resu...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ERPNext 15.89.0 and earlier versions, which stems from improper handling of the topostingdate parameter in the getoutstandingreferencedocuments function, which could lead to a SQ...