PT-2025-36343 · Erp · Erp

Vietsunshine · Published 2025-09-06 · Updated 2025-09-06 · CVE-2025-58439

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ERP versions prior to 14.89.2 ERP versions 15.0.0 through 15.75.1

Description ERP, a free and open source Enterprise Resource Planning tool, is susceptible to error-based SQL Injection due to insufficient validation of parameters. This allows retrieval of some information, such as the version.

Recommendations Update to ERP version 14.89.2 or later. Update to ERP version 15.76.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-58439

GHSA-FVJW-5W9Q-6V39

Affected Products

Erp

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58439.json · Exploit
• https://github.com/frappe/erpnext/security/advisories/GHSA-fvjw-5w9q-6v39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58439 · Security Note
• https://github.com/frappe/erpnext/pull/49220 · Note
• https://github.com/frappe/erpnext/pull/49219 · Note
• https://t.me/cveNotify/134525 · Telegram Post
• https://twitter.com/cypmsecnews/status/1964149470666375368 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1964260362217230833 · Twitter Post
• https://t.me/canyoupwnme/6920 · Telegram Post
• https://twitter.com/CVEnew/status/1964195406709215684 · Twitter Post
• https://t.me/CVEtracker/31837 · Telegram Post