CVE-2025-52041

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52041
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventory_dimensions_dict parameter.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md Exploit Third Party Advisory
https://github.com/frappe/erpnext/pull/49192/commits/eb22794f14351c2ff5731548c48bef0b91765c86 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:frappe:erpnext:15.57.5:*:*:*:*:*:*:*
History

03 Oct 2025, 16:19

Type Values Removed Values Added
References () https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - () https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - Exploit, Third Party Advisory
References () https://github.com/frappe/erpnext/pull/49192/commits/eb22794f14351c2ff5731548c48bef0b91765c86 - () https://github.com/frappe/erpnext/pull/49192/commits/eb22794f14351c2ff5731548c48bef0b91765c86 - Patch
First Time Frappe erpnext
Frappe
CPE cpe:2.3:a:frappe:erpnext:15.57.5:*:*:*:*:*:*:*

01 Oct 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-01 15:15

Updated : 2025-10-03 16:19

NVD link : CVE-2025-52041

Mitre link : CVE-2025-52041

CVE.ORG link : CVE-2025-52041

JSON object : View

Products Affected

frappe

  • erpnext
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')