by Kastro
Paper/Archive/CVE-2025-58439

CVE-2025-58439

frappe erpnext — ERP: Possibility of SQL injection due to missing validation

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 26.3.263 × 205.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retrieved. This issue is fixed in versions 14.89.2 and 15.76.0.

Affected

ProductAffectedFixed inSource
erpnext>=15.0.0, < 15.76.0–CNA
erpnext< 14.89.2–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/frappe/erpnext/security/advisories/GHSA-fvjw-5w9q-6v39refgithub.com/frappe/erpnext/pull/49219refgithub.com/frappe/erpnext/pull/49220