CVE-2025-52050: SQL Injection
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 09:08 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should immediately review and restrict access to ERPNext instances, especially those exposed to the internet. Network-level protections such as Web Application Firewalls (WAFs) should be configured to detect and block SQL injection patterns targeting the expiry_date parameter. Organizations should audit their ERPNext installations and apply any available patches or updates from the vendor as soon as they are released. In the absence of official patches, temporary mitigations include implementing input validation and sanitization on the expiry_date parameter, using parameterized queries or prepared statements in the codebase, and restricting database user permissions to minimize data exposure. Regular security assessments and penetration testing focused on injection vulnerabilities should be conducted. Additionally, monitoring database query logs for unusual or suspicious activity related to loyalty program queries can help detect exploitation attempts early. Finally, organizations should ensure compliance with data protection regulations by preparing incident response plans in case of data breaches.
Description
In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expiry_date parameter.