What is the CVSS score of EUVD-2026-55830?

EUVD-2026-55830 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-55830?

Yes, a patch is available for EUVD-2026-55830. Update the affected software to the latest version immediately.

ERPNext EUVD-2026-55830

| CVE-2026-72908 MEDIUM

SQL Injection (CWE-89)

2026-08-10 GitHub_M

SQLi Erpnext

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable via standard HTTP, low complexity, low-privilege auth required; high confidentiality only, no integrity or availability impact confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 22:04 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 21:21 vuln.today

Analysis Generated

Aug 10, 2026 - 21:21 vuln.today

DescriptionCVE.org

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.

AnalysisAI

SQL injection in ERPNext's tax rule engine allows any authenticated low-privilege user to extract arbitrary database content. The get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py directly interpolated request-supplied posting_date and args dictionary values into raw SQL WHERE clauses via Python f-strings and .format() calls, bypassing all parameterization. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privilege ERPNext credentials

Delivery

Send crafted transaction request with injected SQL in posting_date or args field

Exploit

Trigger get_tax_template SQL construction in tax_rule.py

Execution

Malicious payload executes in database context

Impact

Extract sensitive tables (users, financials, PII) via UNION or blind injection

Access

Obtain low-privilege ERPNext credentials

Delivery

Send crafted transaction request with injected SQL in posting_date or args field

Exploit

Trigger get_tax_template SQL construction in tax_rule.py

Execution

Malicious payload executes in database context

Impact

Extract sensitive tables (users, financials, PII) via UNION or blind injection

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated session with at least low-privilege access to ERPNext - any user role that can initiate or view sales orders, purchase orders, or other transaction types that trigger tax template resolution is sufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the exploitation profile: network-reachable, low attack complexity, requiring only low-privilege authentication, with high confidentiality impact and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with any valid ERPNext account - including a minimal-privilege role such as a sales user or purchase user - crafts a request to a transaction endpoint that invokes get_tax_template, injecting a SQL fragment into the posting_date or a transaction argument field. The injected payload appends a UNION SELECT or boolean-based blind condition that extracts data from sensitive tables such as tabUser, tabEmployee, or tabBank Account. …
Remediation	Upgrade ERPNext to version 15.109.0 (release tag: https://github.com/frappe/erpnext/releases/tag/v15.109.0) or 16.20.0 (https://github.com/frappe/erpnext/releases/tag/v16.20.0), both of which contain the complete fix via migration to the Frappe query builder. … Detailed patch versions, workarounds, and compensating controls in full report.