{"id":"CVE-2025-66439","title":"An issue was discovered in Frappe ERPNext through 15.89.0","summary":"An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitra…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-89","CWE-89"],"vendor":"frappe","product":"erpnext","affected":["erpnext <= 15.89.0"],"published":"2025-12-15","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66439","references":[{"url":"https://github.com/frappe/frappe/security","label":"cve@mitre.org"},{"url":"https://iamanc.github.io/post/erpnext-sqli","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00379,"epssPercentile":0.29956,"ingestedAt":"2026-10-14T13:30:58.431Z","slug":"CVE-2025-66439","body":"## Overview\n\nAn issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the from_posting_date parameter, which is directly interpolated into the query without proper sanitization or parameter binding.\n\n## Affected\n\n- `erpnext <= 15.89.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}