In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventory_dimensions_dict parameter.
CVE-2025-52041
CVSS base score
8.2 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-89
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected products
frappe erpnext
References
- github.com Exploit, Third Party Advisory
- github.com Patch