An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext/accounts/doctype/payment_entry/payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the to_posting_date parameter, which is directly interpolated into the query without proper sanitization or parameter binding.
References
| Link | Resource |
|---|---|
| https://github.com/frappe/frappe/security | Product |
| https://iamanc.github.io/post/erpnext-sqli | Exploit Third Party Advisory |
Configurations
History
05 Jan 2026, 18:23
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* | |
| First Time |
Frappe erpnext
Frappe |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | () https://github.com/frappe/frappe/security - Product | |
| References | () https://iamanc.github.io/post/erpnext-sqli - Exploit, Third Party Advisory |
16 Dec 2025, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
15 Dec 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-15 18:15
Updated : 2026-01-05 18:23
NVD link : CVE-2025-66440
Mitre link : CVE-2025-66440
CVE.ORG link : CVE-2025-66440
JSON object : View
Products Affected
frappe
- erpnext
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')