SQL Injection Vulnerability in SIMPLE.ERP Software by SIMPLE

CVE-2025-9339

What is CVE-2025-9339?

An SQL injection vulnerability has been identified in the warehouse document filtering form of SIMPLE.ERP software. This flaw enables logged-in users to submit a payload of up to 20 characters, allowing significant actions such as the deletion of database tables with names limited to a maximum of 6 characters. Although exploitation does not seem to extend to data exfiltration due to the query character limit, the potential for destructive actions raises serious concerns about data integrity and security within the application.

References