PT-2025-51260 · Frappe · Erpnext

Published 2025-12-15 · Updated 2026-01-05 · CVE-2025-66439

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions through 15.89.0

Description An issue exists in Frappe ERPNext that allows an attacker to extract arbitrary data from the database. The get outstanding reference documents() function, located at erpnext.accounts.doctype.payment entry.payment entry.py, is susceptible to SQL Injection. This is due to the direct interpolation of the from posting date parameter into a query without proper sanitization or parameter binding. The API endpoint is not explicitly mentioned. The vulnerable parameter is from posting date.

Recommendations Versions prior to 15.89.0 should be updated.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-66439

Affected Products

Erpnext

References · 7

• 🔥 https://iamanc.github.io/post/erpnext-sqli · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66439 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66439 · Vendor Advisory
• https://github.com/frappe/frappe/security · Note
• https://t.me/cveNotify/147742 · Telegram Post
• https://twitter.com/CVEnew/status/2002857401876353445 · Twitter Post
• https://t.me/CVEtracker/39863 · Telegram Post