CVE-2025-66440

Frappe ERPNext versions through 15.89.0 are vulnerable to SQL Injection in the get_outstanding_reference_documents() function located at erpnext/accounts/doctype/payment_entry/payment_entry.py. The root cause is the direct interpolation of the to_posting_date parameter into a database query witho...