CVE-2025-52047: Frappe ErpNext · SQL Injection
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should first identify if they are running the affected version of Frappe ErpNext (v15.57.5). Immediate steps include: 1) Restricting access to the ERP system interfaces that accept the filters.disabled parameter, ensuring only trusted and authenticated users can interact with these endpoints. 2) Implementing Web Application Firewalls (WAFs) with SQL Injection detection and prevention rules tailored to detect anomalous input patterns targeting the filters.disabled parameter. 3) Conducting thorough input validation and sanitization on all user-supplied data, especially parameters used in SQL queries, to prevent injection attacks. 4) Monitoring database query logs for unusual or suspicious queries that could indicate exploitation attempts. 5) Applying the principle of least privilege on database accounts used by the ERP application, limiting their ability to perform unauthorized data access or modifications. 6) Engaging with the ErpNext community or vendor for official patches or updates addressing this vulnerability and applying them promptly once available. 7) Performing regular security assessments and penetration testing focused on injection vulnerabilities within ERP modules. These measures combined will reduce the attack surface and help detect or prevent exploitation of this SQL Injection flaw.
Description
In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter.