In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter.
CVE-2025-52042
CVSS base score
8.2 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-89
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected products
frappe erpnext
References
- github.com Exploit, Third Party Advisory
- github.com Patch