CVE-2025-52050

Katalog CVE

CVSS 6.5 · Medium EPSS 0,27%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada frappe erpnext. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expiry_date parameter.

Rincian

Terbit di NVD

30 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/frappe/erpnext/pull/49192/commits/8696ba2f5d9e99c799d4aef577f72f2fae5678e7 patch
• https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Fram... exploit · advisory pihak ketiga