CVE-2025-52042
High
Description
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter.
SeverityHigh
CVSS8.2
Exploit probability—
Product
Frappe Erpnext
PublishedOct 1, 2025
First seenOct 1, 2025
Weakness typeCWE-89SQL injection
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| frappe erpnext | 15.57.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.