PT-2025-51261 · Frappe · Erpnext

Published 2025-12-15 · Updated 2026-01-05 · CVE-2025-66440

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions through 15.89.0

Description A SQL injection issue exists in Frappe ERPNext. The get outstanding reference documents() function within the erpnext/accounts/doctype/payment entry/payment entry.py file is susceptible to exploitation. An attacker can extract data from the database by injecting SQL payloads through the to posting date parameter. This parameter is directly incorporated into database queries without adequate sanitization or parameter binding.

Recommendations Versions prior to 15.89.0 are recommended to be updated.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-66440

Affected Products

Erpnext

References · 8

• 🔥 https://iamanc.github.io/post/erpnext-sqli · Exploit
• https://osv.dev/vulnerability/CVE-2025-66440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66440 · Security Note
• https://github.com/frappe/frappe/security · Note
• https://t.me/cveNotify/147743 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000638276206539043 · Twitter Post
• https://twitter.com/CVEnew/status/2002857402744606884 · Twitter Post
• https://t.me/CVEtracker/39864 · Telegram Post