Description Summary:
ERPNext contains a template injection vulnerability that allows authenticated users to execute arbitrary server-side code by manipulating template parameters in processing functions.

Executive Summary:
An authenticated template injection vulnerability in ERPNext enables users with operational roles to execute arbitrary server-side code, resulting in total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72911

Affected Software: frappe erpnext

Affected Versions: < 15.118.0, >= 16.0.0 < 16.29.0

Vulnerability: The application improperly neutralizes special elements in template engines (CWE-1336) within the process_statement_of_accounts module. An authenticated user can inject malicious expressions to execute code or access data, despite requiring prior authentication.

Business Impact

This vulnerability allows an attacker with legitimate system access to elevate their privileges and execute arbitrary code on the underlying host. The ability to read or modify data across the entire application, combined with the potential for remote code execution, presents a severe risk to organizational operations and data integrity.

Remediation Plan

Immediate Action: Update ERPNext to version 15.118.0, 16.29.0, or higher to ensure the template rendering logic is secured.

Proactive Monitoring: Monitor for anomalous server-side process execution or unexpected file system modifications originating from the ERPNext application account.

Compensating Controls: Restrict access to sensitive modules, such as account processing, to the minimum number of users required to perform business functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authenticated access slightly lowers the initial attack vector, but the impact of code execution remains critical.

Analyst Recommendation

Administrators should update their ERPNext instances immediately to prevent internal threats from escalating to full system compromise. Review user roles and permissions to ensure that access to template-related functions is strictly controlled until the patch is applied.

Description Summary:
Frappe framework contains a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthenticated attackers to perform unauthorized actions on behalf of users.

Executive Summary:
Frappe framework is vulnerable to a Cross-Site Request Forgery (CSRF) flaw that could allow unauthorized actions, posing a high risk to application integrity.

Vulnerability Details

CVE-ID: CVE-2026-66001

Affected Software: Frappe Frappe

Affected Versions: < 15.114.0, >= 16.0.0-beta.1, < 16.26.0

Vulnerability: This is a Cross-Site Request Forgery (CWE-352) vulnerability. The framework fails to properly validate requests, allowing an unauthenticated attacker to trick an authenticated user into executing unintended actions within the application.

Business Impact

The vulnerability carries a CVSS score of 8.5, indicating a high level of severity. Successful exploitation could allow attackers to perform administrative actions, modify sensitive data, or change user account settings without the victim's consent. This presents a significant risk to the confidentiality and integrity of business processes managed within the Frappe ecosystem.

Remediation Plan

Immediate Action: Upgrade to version 15.114.0 or later for the 15.x branch, or 16.26.0 or later for the 16.x branch, to apply the necessary CSRF protection patches.

Proactive Monitoring: Review application access logs for suspicious patterns, particularly unusual POST requests originating from unexpected sources or lacking proper origin headers.

Compensating Controls: Ensure the deployment environment enforces strict SameSite cookie attributes and consider implementing a Web Application Firewall (WAF) to filter malicious requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is rooted in the handling of state-changing requests, which is a common target for automated web exploitation.

Analyst Recommendation

Given the high CVSS score and the nature of CSRF vulnerabilities, administrators should prioritize this update. Applying the provided patches is the most effective way to secure the framework against unauthorized request manipulation.

Description Summary:
A permission boundary bypass in Frappe leads to server-side template injection and remote code execution in ERPNext due to improper handling of the frappe.render_template function.

Executive Summary:
An authenticated remote code execution vulnerability in ERPNext allows users to bypass permission boundaries and execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-65974

Affected Software: frappe erpnext

Affected Versions: Versions prior to 15.111.0 and versions 16.0.0 through 16.21.9.

Vulnerability: The vulnerability arises because the frappe.render_template function is exposed without adequate global restriction checks. Authenticated users with limited privileges can leverage this to perform server-side template injection, resulting in remote code execution.

Business Impact

A successful exploit allows an authenticated user to achieve remote code execution, effectively granting them control over the ERP system. This compromises the confidentiality, integrity, and availability of sensitive business data, including financial records and operational intelligence. With a CVSS score of 9.9, this vulnerability represents an extreme risk to enterprise environments.

Remediation Plan

Immediate Action: Update frappe erpnext to version 15.111.0 or 16.22.0 immediately.

Proactive Monitoring: Audit audit logs for unusual template rendering activity or attempts to access restricted system functions by standard user accounts.

Compensating Controls: Restrict access to the application to trusted users only and employ Web Application Firewalls to filter for suspicious template injection patterns.

Exploitation Status

Public Exploit Available: No confirmed public weaponized exploit is available at this time.

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication limits the attack surface, but the potential for total system compromise remains high.

Analyst Recommendation

Organizations running ERPNext must apply the provided security updates immediately. Given the high severity and the potential for full system compromise, administrators should treat this as a high-priority maintenance task to ensure the security of their enterprise data.

Description Summary:
ERPNext is susceptible to SQL injection, allowing authenticated users to manipulate database queries through improper neutralization of special elements.

Executive Summary:
A high-severity SQL injection vulnerability in ERPNext allows authenticated attackers to potentially compromise database integrity and access sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-65822

Affected Software: frappe erpnext

Affected Versions: < 15.116.0, >= 16.0.0, < 16.23.0

Vulnerability: The application is vulnerable to SQL injection (CWE-89) because it fails to properly neutralize special elements used in SQL commands. This vulnerability requires the attacker to have authenticated access to the system.

Business Impact

SQL injection is a critical vector for data theft, unauthorized modification of records, and potential service disruption. With a CVSS score of 7.6, this vulnerability poses a high risk to the business, as an attacker could extract sensitive ERP data or manipulate financial and operational records.

Remediation Plan

Immediate Action: Upgrade ERPNext to version 15.116.0 or 16.23.0, depending on the current branch, to mitigate the SQL injection risk.

Proactive Monitoring: Monitor database query logs for suspicious SQL syntax, such as UNION statements or unexpected comment characters, which may indicate attempted injection.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection rules to inspect incoming requests and block malicious payloads.

Exploitation Status

Public Exploit Available: No (exploit_available false).

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection remains a dangerous class of vulnerability that can be highly damaging if exploited.

Analyst Recommendation

Given the sensitive nature of data managed by ERPNext, this vulnerability should be addressed immediately. Administrators must prioritize applying the provided security releases to ensure database integrity and confidentiality.

Description Summary:
The Frappe framework is vulnerable to path traversal, which could allow an authenticated high-privileged user to access or manipulate restricted files on the server.

Executive Summary:
A high-severity path traversal vulnerability in the Frappe framework allows authenticated high-privileged users to compromise system files.

Vulnerability Details

CVE-ID: CVE-2026-55852

Affected Software: Frappe

Affected Versions: < 15.112.0, >= 16.0.0-beta.1, < 16.23.0

Vulnerability: This vulnerability (CWE-22) is caused by improper limitation of pathnames to restricted directories. An attacker with high-level privileges can traverse the filesystem to access files outside of the intended application directory.

Business Impact

Exploitation of this path traversal flaw could lead to full system compromise, including the retrieval of sensitive configuration files or the overwriting of critical system components. With a CVSS score of 8.6, this vulnerability represents a severe threat to infrastructure integrity and security.

Remediation Plan

Immediate Action: Update the Frappe framework to version 15.112.0 or 16.23.0 immediately to include the necessary path validation fixes.

Proactive Monitoring: Audit server file system access logs for suspicious traversal patterns (e.g., ../../) originating from administrative accounts.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the filesystem access of the web server process to only the necessary directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for high-level system impact, it is imperative to apply the provided patches to the Frappe framework. Administrators should prioritize upgrading to the patched versions to prevent unauthorized file access and potential escalation of privileges.

Description Summary:
ERPNext is vulnerable to incorrect authorization and improper template engine neutralization, which can be exploited by an authenticated local user.

Executive Summary:
An authorization and template injection flaw in ERPNext allows authenticated local users to achieve escalated privileges and potential system-wide compromise.

Vulnerability Details

CVE-ID: CVE-2026-55242

Affected Software: frappe erpnext

Affected Versions: Versions < 15.111.0, and versions >= 16.0.0 and < 16.22.0

Vulnerability: The vulnerability stems from incorrect authorization (CWE-863) and improper neutralization of special elements in a template engine (CWE-1336). It requires low-privileged authenticated access to the system to trigger the flaw.

Business Impact

Although exploitation requires authenticated access, the ability to achieve total technical impact (as indicated by the CVSS score of 8.8) makes this a significant risk. An attacker could bypass existing authorization controls, manipulate business data, or execute arbitrary code in the context of the application, leading to severe operational and data integrity risks.

Remediation Plan

Immediate Action: Update ERPNext to version 15.111.0 or 16.22.0, depending on the current deployment branch, to apply the necessary security patches.

Proactive Monitoring: Audit user activity logs, particularly those involving administrative or template-related functions, for signs of unauthorized access or escalation attempts.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and minimize the number of users with system-level permissions to reduce the potential impact of a compromised account.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for complete system compromise once initial access is gained.

Analyst Recommendation

While this vulnerability requires local authentication, the potential for total technical impact is severe. Administrators must prioritize updating ERPNext to the latest secure versions to prevent privilege escalation and ensure the integrity of the enterprise resource planning environment.

Description Summary:
Frappe CRM contains an authentication bypass vulnerability in the crm/api endpoint due to improperly handled invitation keys, allowing unauthorized access.

Executive Summary:
An authentication bypass vulnerability in Frappe CRM versions prior to 1.73.0 allows unauthenticated attackers to potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-53761

Affected Software: Frappe CRM

Affected Versions: < 1.73.0

Vulnerability: This is an improper authentication vulnerability (CWE-287) located in the crm/api endpoint, where an attacker can bypass security controls via logged invitation keys. The vulnerability permits unauthenticated interaction with specific API functions.

Business Impact

Successful exploitation of this flaw allows an attacker to bypass authentication mechanisms, leading to unauthorized actions within the CRM system. Given the CVSS score of 8.2, this represents a high-severity risk that could result in the compromise of sensitive customer data or unauthorized modification of business records.

Remediation Plan

Immediate Action: Update Frappe CRM to version 1.73.0 or later immediately to incorporate the security fix.

Proactive Monitoring: Monitor API access logs for unusual patterns or spikes in requests to the crm/api endpoint, particularly those involving invitation keys.

Compensating Controls: Implement strict rate limiting and IP allowlisting on the API gateway to restrict access to the vulnerable endpoint while the update is being staged.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of September 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its nature as an authentication bypass on an API surface.

Analyst Recommendation

The authentication bypass in Frappe CRM poses a significant risk to organizational data integrity. Administrators must prioritize updating the software to version 1.73.0 to close the vulnerability. Delaying this update leaves the application exposed to unauthorized access, and immediate remediation is strongly advised.

Description Summary:
The Frappe framework contains an origin validation error that could allow unauthorized actions through cross-site request forgery or similar origin-based attacks.

Executive Summary:
An origin validation vulnerability in the Frappe framework could allow an attacker to perform unauthorized actions on behalf of a user.

Vulnerability Details

CVE-ID: CVE-2026-47194

Affected Software: frappe

Affected Versions: >= 16.0.0-beta.1, < 16.18.3, < 15.108.0

Vulnerability: This is a CWE-346 vulnerability regarding origin validation errors. The attack is unauthenticated (PR:N) but relies on user interaction (UI:P), suggesting a client-side execution path where a victim is coerced into performing an action.

Business Impact

Successful exploitation allows an attacker to bypass origin protections, potentially leading to unauthorized data modification or account takeover. With a CVSS score of 8.6, this vulnerability poses a high risk to the integrity of business applications built on the Frappe framework.

Remediation Plan

Immediate Action: Update the Frappe framework to versions 16.18.3 or 15.108.0 or later to resolve the origin validation issue.

Proactive Monitoring: Monitor application access logs for suspicious cross-origin requests or unexpected state-changing operations originating from untrusted sources.

Compensating Controls: Use strict Content Security Policy (CSP) headers to restrict where the application can send and receive data, limiting the impact of origin-based attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The need for user interaction slightly limits the exploitability, but the high impact necessitates immediate patching.

Analyst Recommendation

Framework-level vulnerabilities often affect all dependent modules, making this a critical update. Administrators should test the patch in a staging environment and deploy it to production as soon as possible.

Description Summary:
A SQL injection vulnerability in ERPNext allows authenticated attackers to execute arbitrary SQL commands via improper neutralization of special elements.

Executive Summary:
An authenticated SQL injection vulnerability in ERPNext (CVE-2026-44447) poses a critical risk of full database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-44447

Affected Software: Frappe ERPNext

Affected Versions: frappe erpnext: < 16.9.0

Vulnerability: The application is susceptible to CWE-89 (SQL Injection) because it fails to properly sanitize user-supplied input before using it in database queries. This vulnerability requires the attacker to have low-level authenticated access to the application.

Business Impact

Successful exploitation allows an attacker to bypass security controls, potentially leading to unauthorized access to sensitive business data, modification of records, or complete system takeover. With a CVSS score of 8.8, this flaw represents a significant risk to data integrity and confidentiality, which could result in severe operational disruption and regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade to ERPNext version 16.9.0 or later to ensure the vulnerability is patched.

Proactive Monitoring: Audit database logs for unusual query patterns, such as unexpected syntax errors or suspicious SQL keywords that deviate from standard application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to inspect and filter malicious input directed at the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly exploitable once authenticated, the requirement for credentials limits the initial attack surface.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize patching this vulnerability immediately. Administrators must ensure that all instances of ERPNext are updated to the fixed version to prevent potential database-level compromise.

Description Summary:
ERPNext contains a SQL injection vulnerability that allows authenticated users to execute arbitrary SQL commands due to improper input sanitization.

Executive Summary:
An authenticated SQL injection vulnerability in ERPNext (CVE-2026-44446) presents a critical risk, enabling attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-44446

Affected Software: Frappe ERPNext

Affected Versions: frappe erpnext: >= 16.0.0-beta.1, < 16.14.0, < 15.104.3

Vulnerability: This is a CWE-89 (SQL Injection) vulnerability occurring in the application's query handling layer. Exploitation requires the attacker to be authenticated, though the impact is severe, potentially allowing for full administrative control over the underlying database.

Business Impact

The ability to inject arbitrary SQL queries allows an attacker to exfiltrate sensitive corporate data, alter financial or operational records, or gain unauthorized administrative access. The CVSS score of 8.8 underscores the severity of this risk, posing a threat to the core reliability and security of the ERP system.

Remediation Plan

Immediate Action: Update ERPNext to version 16.14.0 or 15.104.3, depending on the current branch in use.

Proactive Monitoring: Review application access logs and database audit trails for unauthorized query attempts or signs of anomalous database activity.

Compensating Controls: Implement strict input validation at the application level and utilize a WAF to block common SQL injection payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for total database impact, though it is currently not known to be exploited in the wild.

Analyst Recommendation

Immediate remediation is required to secure the database layer. IT teams should verify their current version against the affected ranges and apply the vendor-provided patches as soon as possible to mitigate the risk of data breach.

Description Summary:
A missing authorization vulnerability in ERPNext allows authenticated users to modify data outside their permitted roles.

Executive Summary:
A critical authorization flaw in ERPNext allows authenticated users to escalate their privileges, enabling unauthorized data modification and potential system-wide compromise.

Vulnerability Details

CVE-ID: CVE-2026-44442

Affected Software: Frappe ERPNext

Affected Versions: < 16.9.1

Vulnerability: The issue is a missing authorization check (CWE-862) on specific endpoints. While the vulnerability requires the attacker to be an authenticated user, the flaw allows them to bypass role-based access controls to perform unauthorized actions.

Business Impact

This vulnerability undermines the core security model of the ERPNext platform. An attacker with low-level access can perform administrative tasks or modify sensitive business data, leading to severe operational disruption or financial data compromise. Despite requiring authentication, the CVSS score of 9.9 highlights the extreme impact this has on organizational data integrity.

Remediation Plan

Immediate Action: Upgrade the ERPNext installation to version 16.9.1 or later.

Proactive Monitoring: Audit recent database modification logs for changes made by users that fall outside their assigned roles or standard business workflows.

Compensating Controls: Enforce the principle of least privilege for all user accounts and ensure the ERP instance is not accessible to unauthorized external personnel.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While it requires authentication, the impact is severe, and the vulnerability is inherently exploitable for any user with valid system credentials.

Analyst Recommendation

Organizations using ERPNext must prioritize the update to version 16.9.1. By addressing this authorization bypass, administrators can restore the integrity of their role-based access controls and prevent internal privilege escalation that could lead to widespread system abuse.

Description Summary:
Frappe Framework is vulnerable to path traversal, allowing unauthenticated attackers to retrieve arbitrary files from the server due to insufficient input sanitization on specific requests.

Executive Summary:
A path traversal vulnerability in the Frappe Framework allows unauthenticated attackers to read arbitrary files from the underlying server, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-68953

Affected Software: Frappe Framework

Affected Versions: < 14.99.6, 15.0.0 through 15.80.1

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) residing in the framework's request handling logic. The lack of proper input sanitization allows unauthenticated remote attackers to bypass directory restrictions and access sensitive files on the host system.

Business Impact

Successful exploitation allows an attacker to bypass file system access controls, potentially leading to the exposure of sensitive configuration files, environment variables, or application data. Given the CVSS score of 7.5, this high severity vulnerability could lead to a complete compromise of application confidentiality, providing attackers with the necessary information to facilitate further attacks against the infrastructure.

Remediation Plan

Immediate Action: Upgrade to Frappe Framework version 14.99.6 or 15.88.1 to apply the vendor-supplied security patches.

Proactive Monitoring: Review web server and application access logs for suspicious patterns, specifically requests containing directory traversal sequences such as dot-dot-slash patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing path traversal sequences or utilize a reverse proxy to restrict access to sensitive internal directories.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 7, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the relative ease of triggering path traversal via standard HTTP requests.

Analyst Recommendation

The risk associated with this vulnerability is high due to the lack of required authentication and the potential for unauthorized file disclosure. System administrators should prioritize the application of the official security updates to the affected Frappe versions immediately to eliminate the underlying path traversal flaw and protect sensitive system assets.

Description Summary:
A template injection vulnerability in the Frappe framework allows an authenticated user with specific permissions to trigger remote code execution via a crafted link.

Executive Summary:
A critical remote code execution vulnerability in the Frappe framework allows authenticated attackers to compromise the server via malicious template manipulation.

Vulnerability Details

CVE-ID: CVE-2025-68929

Affected Software: Frappe Framework

Affected Versions: < 14.99.6, 15.0.0 to < 15.88.1

Vulnerability: This flaw is a result of improper neutralization of special elements used in a template engine (CWE-1336). An attacker with authenticated access can exploit this by tricking a user into interacting with a crafted link, leading to arbitrary code execution on the underlying server.

Business Impact

The ability for an attacker to achieve remote code execution represents a total compromise of the application and the host server. Given the CVSS score of 9.0, this vulnerability poses a severe threat, potentially leading to unauthorized data access, complete system takeover, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Update the Frappe Framework to version 14.99.6 or 15.88.1 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor server access logs and application logs for unusual URL structures or unexpected template processing errors that may indicate exploitation attempts.

Compensating Controls: Implement a strict Content Security Policy (CSP) and use a Web Application Firewall (WAF) to filter suspicious incoming requests containing template-specific characters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Dec 29, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires a level of user interaction, but the high severity reflects the ease with which an authenticated user can be manipulated to trigger the flaw.

Analyst Recommendation

The risk associated with this vulnerability is high due to the potential for full server compromise. IT administrators should prioritize the deployment of the updated framework versions across all environments. Failure to patch allows for a critical attack vector that could result in total loss of system integrity.

Description Summary:
Frappe is vulnerable to error-based SQL injection due to insufficient parameter validation, potentially allowing authenticated attackers to retrieve sensitive system information.

Executive Summary:
A high-severity SQL injection vulnerability in the Frappe framework allows authenticated attackers to extract sensitive information, necessitating an immediate update to patched versions.

Vulnerability Details

CVE-ID: CVE-2025-66205

Affected Software: Frappe

Affected Versions: >= 15.0.0, < 15.86.0, < 14.99.2

Vulnerability: This vulnerability is an error-based SQL injection (CWE-89) arising from a lack of input validation on specific endpoints. The vulnerability requires the attacker to have low-level privileges (authenticated access) to trigger the injection, which can lead to the exposure of backend database information.

Business Impact

Successful exploitation allows an attacker to interact with the underlying database to extract sensitive metadata or system information. With a CVSS score of 7.1, this flaw poses a significant risk to data confidentiality and application integrity. While the attack requires authentication, the potential for unauthorized data disclosure can lead to severe regulatory non-compliance and loss of operational trust.

Remediation Plan

Immediate Action: Upgrade to Frappe version 15.86.0 or 14.99.2 immediately to apply the vendor-provided security patches.

Proactive Monitoring: Review application access logs for unusual error patterns or suspicious SQL syntax within request parameters directed at the framework endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which can provide temporary protection while the patching process is completed.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of December 1, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user, making the application of vendor patches the most effective defense against potential internal or compromised-account threats.

Analyst Recommendation

Given the ease of exploitability and the potential for unauthorized information disclosure, organizations utilizing the Frappe framework must prioritize this update. Administrative teams should verify their current version string against the affected range and schedule an immediate patch deployment to eliminate the risk of SQL injection.

Description Summary:
Frappe ERPNext is vulnerable to error-based SQL injection due to insufficient parameter validation, allowing authenticated attackers to retrieve sensitive system information.

Executive Summary:
Frappe ERPNext contains a critical SQL injection vulnerability that allows authenticated attackers to potentially exfiltrate sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-58439

Affected Software: Frappe ERPNext

Affected Versions: >=15.0.0, < 15.76.0; < 14.89.2

Vulnerability: The application fails to properly validate parameters before processing them in database queries, resulting in an error-based SQL injection flaw. This vulnerability is exploitable by any authenticated user with access to the affected endpoints.

Business Impact

Successful exploitation of this flaw allows an attacker to execute arbitrary SQL commands, leading to the unauthorized disclosure of sensitive business information. With a CVSS score of 8.1, the vulnerability represents a high risk to data confidentiality and integrity, potentially exposing ERP data, configuration details, or credentials to malicious actors.

Remediation Plan

Immediate Action: Update Frappe ERPNext to version 15.76.0 or 14.89.2 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review application and database access logs for unusual error patterns or suspicious query structures that may indicate attempted SQL injection.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting application parameters.

Exploitation Status

Public Exploit Available: No — exploit_available (false).

Analyst Notes: As of September 7, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to bypass standard input sanitization, making immediate patching the only reliable method of mitigation.

Analyst Recommendation

Given the high CVSS score and the nature of SQL injection, organizations should prioritize upgrading their ERPNext instances to the latest patched versions. Failure to remediate this vulnerability leaves the application and its underlying data exposed to unauthorized access, which could have severe consequences for business operations and data privacy.

Description Summary:
Frappe ERPNext v15.57.5 contains a SQL injection vulnerability in the get_stock_balance function, allowing unauthenticated attackers to extract database information via the inventory_dimensions_dict parameter.

Executive Summary:
A critical SQL injection vulnerability in Frappe ERPNext version 15.57.5 allows unauthenticated attackers to exfiltrate sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-52044

Affected Software: Frappe ERPNext

Affected Versions: 15.57.5

Vulnerability: The application fails to properly sanitize the inventory_dimensions_dict parameter within the get_stock_balance function located in erpnext/stock/utils.py. This flaw permits an unauthenticated attacker to inject malicious SQL queries and extract data directly from the backend database.

Business Impact

The ability for an unauthenticated user to perform arbitrary database queries poses a significant risk to data confidentiality. A successful exploit could lead to the unauthorized disclosure of proprietary business data, customer records, or financial information, potentially resulting in regulatory noncompliance and severe reputational harm. Given the CVSS score of 7.5, this high-severity vulnerability must be prioritized to prevent potential data breaches.

Remediation Plan

Immediate Action: Organizations should review the referenced GitHub pull request to identify the required code changes and apply the fix to the affected erpnext/stock/utils.py file. If a formal vendor patch is not yet available, restrict access to the affected inventory endpoints until the patch is deployed.

Proactive Monitoring: Monitor database access logs for unusual query patterns, specifically those containing SQL keywords such as UNION, SELECT, or SLEEP, originating from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection patterns targeting common ERP parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the researcher's disclosure on GitHub.

Analyst Notes: As of September 17, 2025, there is no public information indicating active exploitation in the wild; however, a published proof-of-concept exists via the technical write-up provided by the vulnerability researchers. The flaw is inherently dangerous due to its unauthenticated nature and the ease of programmatic exploitation.

Analyst Recommendation

This vulnerability represents a high risk to the integrity and confidentiality of the ERPNext environment. Security teams must treat this as a priority update, leveraging the provided commit information to verify their current version and apply the necessary code-level remediation immediately to block unauthorized database access.

Description Summary:
Frappe ERPNext 15.57.5 contains a SQL injection vulnerability in the get_rfq_containing_supplier function, allowing unauthenticated attackers to extract database information via the txt parameter.

Executive Summary:
A critical SQL injection vulnerability in Frappe ERPNext 15.57.5 allows unauthenticated remote attackers to extract sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-52042

Affected Software: Frappe ERPNext

Affected Versions: 15.57.5

Vulnerability: The application fails to properly sanitize input in the get_rfq_containing_supplier function within the file erpnext/buying/doctype/request_for_quotation/request_for_quotation.py. An unauthenticated attacker can supply a malicious SQL query via the txt parameter to exfiltrate data from the underlying database.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to sensitive business data stored within the ERPNext database. Given the CVSS score of 8.2, this represents a high risk that could lead to full data compromise, loss of confidentiality, and regulatory non-compliance.

Remediation Plan

Immediate Action: Review the vendor GitHub pull request 49192 to identify the specific code fix and apply the corresponding patch to your instance immediately.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing SQL syntax or unusual patterns in the txt parameter associated with the request_for_quotation endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming URI parameters.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists via the researcher's technical disclosure.

Analyst Notes: As of October 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

This vulnerability presents a significant risk to the confidentiality of organizational data. Administrators should prioritize patching the vulnerable function identified in the provided technical references. If an immediate update is not feasible, ensure that rigorous WAF filtering is active to block malicious injection attempts until the software can be updated.

Description Summary:
Frappe ERPNext 15.57.5 contains a SQL injection vulnerability in the get_stock_balance_for function, allowing unauthenticated attackers to extract database information via the inventory_dimensions_dict parameter.

Executive Summary:
A critical SQL injection vulnerability in Frappe ERPNext 15.57.5 allows unauthenticated attackers to perform unauthorized database queries and data extraction.

Vulnerability Details

CVE-ID: CVE-2025-52041

Affected Software: Frappe ERPNext

Affected Versions: 15.57.5

Vulnerability: This is an SQL injection vulnerability located within the get_stock_balance_for() function in the stock_reconciliation.py file. The flaw allows an unauthenticated attacker to inject malicious SQL queries through the inventory_dimensions_dict parameter to exfiltrate sensitive data.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, potentially leading to the full compromise of ERP data, including financial records and inventory information. With a CVSS score of 8.2, this vulnerability represents a significant risk to data confidentiality and integrity, necessitating immediate attention to prevent potential data breaches.

Remediation Plan

Immediate Action: Review the official Frappe ERPNext repository for patch releases or backported fixes, specifically referencing commit eb22794f14351c2ff5731548c48bef0b91765c86, and apply updates as soon as they are available.

Proactive Monitoring: Monitor application logs for suspicious database query patterns or unusually long execution times that may indicate automated SQL injection attempts against the stock reconciliation module.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the inventory_dimensions_dict parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the vulnerability disclosure linked in the enrichment references.

Analyst Notes: As of October 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it is remotely exploitable without authentication and is automatable.

Analyst Recommendation

Given the high severity and the availability of a public proof-of-concept, organizations running Frappe ERPNext 15.57.5 must treat this vulnerability with high urgency. Administrators should prioritize applying the vendor provided fix once released and restrict access to the affected endpoint until the patch is successfully deployed.

Description Summary:
Frappe ERPNext 15.57.5 contains a SQL injection vulnerability in the get_blanket_orders function, allowing unauthenticated attackers to extract sensitive database information.

Executive Summary:
An unauthenticated SQL injection vulnerability in Frappe ERPNext 15.57.5 allows remote attackers to perform unauthorized database queries and extract sensitive information.

Vulnerability Details

CVE-ID: CVE-2025-52040

Affected Software: Frappe ERPNext

Affected Versions: 15.57.5

Vulnerability: The application is vulnerable to SQL injection via the blanket_order_type parameter in the get_blanket_orders function located within erpnext/controllers/queries.py. This flaw permits an unauthenticated attacker to inject malicious SQL queries to bypass security controls and retrieve data from the backend database.

Business Impact

The ability to perform unauthenticated SQL injection poses a severe risk to data confidentiality and integrity. Given the CVSS score of 8.2, this vulnerability could lead to the total exposure of sensitive business data stored within the ERP system, potentially resulting in regulatory non-compliance, loss of intellectual property, and significant reputational damage.

Remediation Plan

Immediate Action: Update Frappe ERPNext to a version that incorporates the fix provided in the vendor pull request (commit 1db135262d9474411ef54e3367d24bb169d2503e).

Proactive Monitoring: Monitor database query logs for syntax errors, unexpected UNION operators, or unusual access patterns originating from the get_blanket_orders endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection patterns in HTTP requests targeting the ERPNext framework.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing attack details has been published by a security researcher.

Analyst Notes: As of October 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the affected endpoint.

Analyst Recommendation

This vulnerability represents a high-risk entry point for unauthorized actors to compromise the integrity and confidentiality of the Frappe ERPNext environment. Organizations are strongly advised to verify their current version and apply the upstream patch immediately to prevent potential data exfiltration.

Description Summary:
Frappe ERPNext 15.57.5 contains a SQL injection vulnerability in the get_material_requests_based_on_supplier function, allowing unauthenticated attackers to extract sensitive database information.

Executive Summary:
An unauthenticated SQL injection vulnerability in Frappe ERPNext 15.57.5 poses a critical risk of unauthorized data exfiltration.

Vulnerability Details

CVE-ID: CVE-2025-52039

Affected Software: Frappe ERPNext

Affected Versions: 15.57.5

Vulnerability: The application fails to properly sanitize input within the txt parameter of the get_material_requests_based_on_supplier function located in erpnext/stock/doctype/material_request/material_request.py. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL queries against the underlying database.

Business Impact

The ability for an unauthenticated attacker to perform SQL injection directly threatens the confidentiality and integrity of the organization's ERP data. Given the CVSS score of 8.2, this vulnerability could lead to the complete compromise of sensitive business records, financial information, or customer data, resulting in severe regulatory and reputational consequences.

Remediation Plan

Immediate Action: Review the provided vendor pull request and apply the corresponding security patch to the erpnext/stock/doctype/material_request/material_request.py file.

Proactive Monitoring: Monitor database query logs for suspicious patterns, specifically looking for unusual syntax or high volumes of unexpected queries originating from the material request endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious input directed at the vulnerable material request parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the vulnerability disclosure referenced in the enrichment data.

Analyst Notes: As of October 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

This vulnerability represents a significant security risk due to its potential for unauthenticated data exfiltration. System administrators should prioritize the application of the vendor-provided fix immediately. If a formal patch is not yet available through your distribution channel, apply the logic changes from the official commit to mitigate the risk until an official update is released.