CVE-2025-52042: SQL Injection
Published Oct 1, 2025
·Updated
In Frappe ERPNext 15.57.5, the function getrfqcontainingsupplier() at erpnext/buying/doctype/requestforquotation/requestforquotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter.
Affected Software
2 affected components
Frappe ERPNext
Frappe ERPNext=15.57.5
Remediation
Event History
Oct 1, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-52042?
CVE-2025-52042 is classified as a critical vulnerability due to its potential for SQL Injection.
2
How do I fix CVE-2025-52042?
To fix CVE-2025-52042, update Frappe ERPNext to the latest patched version that addresses this vulnerability.
3
Who is affected by CVE-2025-52042?
CVE-2025-52042 affects all versions of Frappe ERPNext up to 15.57.5.
4
What type of vulnerability is CVE-2025-52042?
CVE-2025-52042 is an SQL Injection vulnerability that allows attackers to manipulate database queries.
5
What impact does CVE-2025-52042 have on affected systems?
CVE-2025-52042 can allow an attacker to extract sensitive information from the database.