CVE-2025-52040 | THREATINT

Description

In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanket_order_type parameter.

PUBLISHED Reserved 2025-06-16 | Published 2025-10-01 | Updated 2025-10-01 | Assigner mitre

References

github.com/...5/Frappe Framework - Multiple SQL Injection.md

github.com/...mmits/1db135262d9474411ef54e3367d24bb169d2503e

cve.org (CVE-2025-52040)

nvd.nist.gov (CVE-2025-52040)

Download JSON