CVE-2026-65822
HIGH
7,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: low
Availability: low
Description
AI Translation Available
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.
89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Authentication
Access Control
Potential Impacts:
Execute Unauthorized Code Or Commands
Read Application Data
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, SQL
Technologies:
Database Server
https://github.com/frappe/erpnext/commit/29dd6e6681d20bbacb69517d2d2c875aa929eb…
https://github.com/frappe/erpnext/commit/f43af6624610e874e61ad3faf8701e5e6be627…
https://github.com/frappe/erpnext/pull/55721
https://github.com/frappe/erpnext/releases/tag/v15.116.0
https://github.com/frappe/erpnext/releases/tag/v16.23.0
https://github.com/frappe/erpnext/security/advisories/GHSA-x35x-4mvx-h959