cert.plThird-party advisory
https://cert.pl/en/posts/2025/10/CVE-2025-9339 CVE-2025-9339
HIGH
SQL Injection in SIMPLE.ERP
Record summary
CVE-2025-9339 has a selected CVSS score of 7.1 (high).
Description
SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6 characters. We weren't able to identify a way to exfiltrate data within query character limit. This issue affects SIMPLE.ERP in versions before 6.30@a04.3.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 21, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
SIMPLE.ERPBrowse Simple SA / SIMPLE.ERPDefault status: unaffected | CVE List | Before 6.30@a04.3 | affected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-9339 simple.com.plproduct
https://simple.com.pl/