CVE-2025-52039

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52039
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md Exploit Third Party Advisory
https://github.com/frappe/erpnext/pull/49192/commits/de919568b4f7a86c8d418c0c3fd88e1f3101696c Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:frappe:erpnext:15.57.5:*:*:*:*:*:*:*
History

03 Oct 2025, 16:19

Type Values Removed Values Added
First Time Frappe erpnext
Frappe
CPE cpe:2.3:a:frappe:erpnext:15.57.5:*:*:*:*:*:*:*
References () https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - () https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - Exploit, Third Party Advisory
References () https://github.com/frappe/erpnext/pull/49192/commits/de919568b4f7a86c8d418c0c3fd88e1f3101696c - () https://github.com/frappe/erpnext/pull/49192/commits/de919568b4f7a86c8d418c0c3fd88e1f3101696c - Patch

01 Oct 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-01 15:15

Updated : 2025-10-03 16:19

NVD link : CVE-2025-52039

Mitre link : CVE-2025-52039

CVE.ORG link : CVE-2025-52039

JSON object : View

Products Affected

frappe

  • erpnext
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')