CVE-2025-66440

CVE-2025-66440 affects Frappe ERPNext up to version 15.89.0. The issue occurs in get_outstanding_reference_documents() within payment_entry.py, where the to_posting_date parameter is directly interpolated into a SQL query without sanitization or parameter binding, enabling SQL injection. The resu...