SQL Injection Vulnerability in Frappe ERPNext by Frappe
CVE-2025-52039
8.2HIGH
What is CVE-2025-52039?
In Frappe ERPNext version 15.57.5, a security vulnerability exists in the function get_material_requests_based_on_supplier() found in material_request.py. This SQL injection flaw enables potential attackers to manipulate SQL queries via the txt parameter, thereby allowing unauthorized access to sensitive information stored in the database. This condition raises serious concerns regarding data integrity and confidentiality and necessitates immediate attention to patch the affected system.
References
CVSS V3.1
Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved