Description
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.
References (2)
Core 2
Core References
Not Applicable
https://github.com/MoAlali/
Scores
CVSS v3
6.5
EPSS
0.0004
EPSS Percentile
11.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (2)
frappe/erpnext
15.67.0
frappe/frappe
15.72.4
Published
Oct 02, 2025
Tracked Since
Feb 18, 2026