EUVD-2026-98040
GHSA-246r-gf9x-4h9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege ERPNext account
-
DeliveryCraft malicious request to vulnerable endpoint
-
ExploitInject SQL via unvalidated input
-
ExecutionDatabase returns sensitive records
-
ImpactExfiltrate confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated ERPNext session with at least low-privilege access (CVSS PR:L) - exploitation is not possible unauthenticated. The attacker must reach one of the specific affected endpoints that lack input validation and send a crafted request; no user interaction (UI:N) and no special non-default configuration are indicated. The limiting factor is the authentication requirement: exposure scales with how many low-trust accounts exist and whether the ERPNext instance is internet-facing. Affected deployments are ERPNext before 15.102.0 and 16.x before 16.11.0; upgrading to 15.102.0 or 16.11.0 removes the condition. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity SQL injection requiring low-privilege authentication (PR:L), with high confidentiality impact but no integrity or availability impact - consistent with a data-exfiltration (read) flaw rather than full database takeover. The 7.1 base score is moderate-to-high but is tempered by the authentication requirement: an attacker needs a valid, if low-privilege, ERPNext account, which lowers real-world exposure compared to an unauthenticated flaw. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or widespread exploitation at this time. This looks like a genuine but not emergency priority: a confirmed authenticated SQLi in a vendor-maintained advisory (GHSA + VulnCheck), worth patching promptly for any multi-tenant or externally-accessible ERPNext deployment where low-privilege accounts are numerous, but not a drop-everything KEV-class issue. Note: exploitation probability (EPSS) is absent, so likelihood cannot be quantified from the data provided. |
| Exploit ScenarioDerived | An attacker who holds any low-privilege authenticated ERPNext account sends specially crafted requests to one of the affected endpoints that fail to validate input, injecting SQL that manipulates the backend query. By doing so they extract sensitive data (e.g., records from other users or modules) that their role should not expose. No public exploit code is identified at time of analysis, and the low attack complexity means exploitation is straightforward once the vulnerable endpoint is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to ERPNext 15.102.0 on the 15.x branch or 16.11.0 on the 16.x branch; these are the fixed versions named in the CVE, and the upgrade removes the unvalidated input path entirely. Apply the upgrade via the standard Frappe bench update workflow, and because ERPNext customizations and third-party apps can override endpoint behavior, retest any custom endpoints after upgrading. Vendor guidance is in the GitHub advisory at https://github.com/frappe/erpnext/security/advisories/GHSA-9ph8-h5v4-97j6, with VulnCheck's advisory at https://www.vulncheck.com/advisories/frappe-erpnext-before-15.102.0-sql-injection-via-unvalidated-endpoint-requests-2. If immediate patching is not possible, compensating controls are: remove or disable unused low-privilege accounts and enforce least privilege on ERPNext roles, since the flaw is only reachable with an authenticated session (trade-off: revoking accounts may interrupt legitimate partner or contractor workflows); restrict network access to the ERPNext instance, particularly removing direct internet exposure and placing it behind a VPN or zero-trust proxy (trade-off: remote user access requires the proxy or VPN path to be maintained); and deploy WAF or reverse-proxy rules that inspect requests to ERPNext endpoints for SQL metacharacter patterns (trade-off: signature-based filtering is evadable via encoding and can generate false positives on legitimate data-entry forms). Additionally, constrain the database account used by the Frappe application to the minimum privileges it needs and monitor query logs for anomalous SELECT patterns from low-privilege sessions, accepting that these are detection controls rather than a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 (SQL Injection) arising from missing input validation on a subset of ERPNext endpoints, where attacker-controlled request parameters reach database query construction without proper parameterization. ERPNext is a Python-based ERP built on the Frappe framework, which typically persists data in MariaDB/MySQL and exposes functionality through REST/RPC-style endpoints; when these endpoints concatenate or interpolate user input into SQL instead of using bound parameters, an authenticated caller can alter the query predicate or append additional read clauses. The CVSS 4.0 vector (VC:H, VI:N, VA:N) and the independent CVSS 3.1 assessment (S:U/C:H/I:N/A:N) agree that the achievable outcome is read-only data extraction rather than writes, schema changes, or denial of service, which is consistent with a SELECT-style injection primitive. The supplied CPE string cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* uses a wildcard version field and therefore confirms the vendor/product identity only - the precise affected ranges (before 15.102.0, and 16.x before 16.11.0) come from the advisory and CVE description, not from the CPE itself. Because exploitation requires PR:L authentication and no user interaction, the practical attack surface is any authenticated interface that exposes the affected endpoints, including internal or partner-facing deployments where low-privilege accounts are common.
Know when Frappe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable SQLi needing a low-privilege account (PR:L), low complexity (AC:L), yielding data disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.
Technical POC Analysis
CWE-89, SQL injection caused by missing input validation.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A SQL injection flaw in Frappe ERPNext (versions before 15.102.0 and 16.x before 16.11.0) allows any user with a valid low-privilege ERP account to read sensitive records stored in the ERP database, including whatever financial, customer, HR, or operational data that instance holds. Because the attack requires only an authenticated session, the practical exposure is proportional to how many low-trust accounts exist on each instance and whether the system is reachable from the internet, and it is confirmed as an unauthenticated-network but authenticated-user vector. Leadership should care because this is a data-exfiltration risk against the system of record for core business processes, and no vendor-released patch for this issue has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict internet exposure of ERPNext instances and limit access to trusted networks or VPN; enforce MFA and aggressively prune low-privilege and stale accounts; apply WAF/reverse-proxy input validation and virtual patching on affected endpoints; enable detailed ERP database query logging with anomaly alerting; and monitor for bulk data-read activity indicative of exfiltration. Note this is an authenticated, low-privilege vector (PR:L) and no public exploit identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
Authenticated SQL injection in Frappe ERPNext through 15.89.0 allows low-privilege users to extract arbitrary database c
SQL injection in Frappe ERPNext through 15.89.0 lets an authenticated attacker with a valid session and access to the Pa
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 lets a user who can create or modify an A
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
Exploit-DB