CVE-2025-52047 | THREATINT

Description

In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter.

PUBLISHED Reserved 2025-06-16 | Published 2025-09-30 | Updated 2025-09-30 | Assigner mitre

References

github.com/...5/Frappe Framework - Multiple SQL Injection.md

github.com/...mmits/6320f7290f93a5278ffdfaa790af70427c20a1c8

cve.org (CVE-2025-52047)

nvd.nist.gov (CVE-2025-52047)

Download JSON