CVE-2025-56381

CVE-2025-56381 affects ERPNext v15.67.0, with SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint exploited via the order_by and group_by parameters. Multiple connected sources (CNVD-2025-31403, RH:CVe-2025-56381, NVD/CVELIST, OSV, CNNVD, Circl) confirm the issue ...