CVE-2025-52040

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52040
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanket_order_type parameter.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md Exploit Third Party Advisory
https://github.com/frappe/erpnext/pull/49192/commits/1db135262d9474411ef54e3367d24bb169d2503e Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:frappe:erpnext:15.57.5:*:*:*:*:*:*:*
History

03 Oct 2025, 16:19

Type Values Removed Values Added
References () https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - () https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - Exploit, Third Party Advisory
References () https://github.com/frappe/erpnext/pull/49192/commits/1db135262d9474411ef54e3367d24bb169d2503e - () https://github.com/frappe/erpnext/pull/49192/commits/1db135262d9474411ef54e3367d24bb169d2503e - Patch
CPE cpe:2.3:a:frappe:erpnext:15.57.5:*:*:*:*:*:*:*
First Time Frappe erpnext
Frappe

01 Oct 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-01 15:15

Updated : 2025-10-03 16:19

NVD link : CVE-2025-52040

Mitre link : CVE-2025-52040

CVE.ORG link : CVE-2025-52040

JSON object : View

Products Affected

frappe

  • erpnext
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')