PT-2025-39990 · Frappe · Erpnext
CVE-2025-52047
·
Published
2025-09-30
·
Updated
2025-09-30
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Frappe ErpNext version 15.57.5
Description
The
get income account() function at erpnext/controllers/queries.py is susceptible to SQL Injection. An attacker can inject a SQL query into the filters.disabled parameter, potentially allowing extraction of all information from databases.Recommendations
Apply a fix that addresses the SQL Injection issue in the
get income account() function at erpnext/controllers/queries.py.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Erpnext