CVE-2025-52042 | THREATINT

Description

In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter.

PUBLISHED Reserved 2025-06-16 | Published 2025-10-01 | Updated 2025-10-01 | Assigner mitre

References

github.com/...5/Frappe Framework - Multiple SQL Injection.md

github.com/...mmits/7f2a52ff71a1fd5d4a9034cf217094c0be9f341a

cve.org (CVE-2025-52042)

nvd.nist.gov (CVE-2025-52042)

Download JSON