Frappe ERPNext 15.57.5
Approved changes feed: RSS · Atom
cpe:2.3:a:frappe:erpnext:15.57.5:*:*:*:*:*:*:*
part: a version: 15.57.5 update: *
| Vendor | Frappe (a51f8b94-1fb6-5e30-97d7-fbeb544c71ba) |
|---|---|
| Product | Erpnext (bd490dec-a7c0-525e-8fd2-591f39522182) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/frappe/erpnext |
purl2cpe | 2026-06-01 10:17:00.629981 |
pkg:sourceforge/erpnext.mirror |
purl2cpe | 2026-06-01 10:17:00.629983 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-52050 |
vulnerable | 2026-06-08 07:31:11.352850 |
Details available
In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expiry_date parameter.
Published: 2025-09-30T00:00:00.000Z
Updated: 2025-09-30T19:41:37.443Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52049 |
vulnerable | 2026-06-08 07:31:11.352473 |
Details available
In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter.
Published: 2025-09-30T00:00:00.000Z
Updated: 2025-09-30T19:37:58.497Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52047 |
vulnerable | 2026-06-08 07:31:11.350128 |
Details available
In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter.
Published: 2025-09-30T00:00:00.000Z
Updated: 2025-09-30T19:43:47.741Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52044 |
vulnerable | 2026-06-08 07:31:11.346115 |
Details available
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventory_dimensions_dict parameter.
Published: 2025-09-16T00:00:00.000Z
Updated: 2025-09-17T13:43:03.696Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52043 |
vulnerable | 2026-06-08 07:31:11.345743 |
Details available
In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter.
Published: 2025-09-30T00:00:00.000Z
Updated: 2025-09-30T19:42:37.445Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52042 |
vulnerable | 2026-06-08 07:31:11.345500 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52041 |
vulnerable | 2026-06-08 07:31:11.345095 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52040 |
vulnerable | 2026-06-08 07:31:11.344598 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52039 |
vulnerable | 2026-06-08 07:31:11.344136 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.