PT-2026-65783
CVE-2026-12895
·
Published
2026-07-29
·
Updated
2026-07-29
Description by
CVSS 4.0
7.1
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
ERPNext version 15.107.0
Frappe version 15.107.2
Description
An issue exists where the application constructs SQL queries using direct string interpolation via
str.format() instead of parameterized queries. This allows the docname of a Supplier record containing SQL metacharacters to be interpreted as part of the query. An authenticated user with low privileges could exploit this to execute arbitrary SQL queries, bypass DocPerm access restrictions, and extract confidential data, including administrator password hash fragments, credentials, integration tokens, or financial information.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾