Untriaged
Permalink
CVE-2026-32954
7.1 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): LOW
ERP has a possibility SQL Injection vulnerability due to missing validation
ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0.
References
- https://github.com/frappe/erpnext/releases/tag/v16.8.0 x_refsource_MISC
- https://github.com/frappe/erpnext/security/advisories/GHSA-j669-ghv2-gmqg x_refsource_CONFIRM
- https://github.com/frappe/erpnext/releases/tag/v15.100.0 x_refsource_MISC
Affected products
erpnext
- ==< 15.100.0
- ==>= 16.0.0-beta.1, < 16.8.0