SQL Injection in Frappe Erpnext
CVE-2026-12895
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (d…
Vulnerability class: SQL Injection
Affected products
- Frappe Erpnext — versions 0
Weakness classification (CWE)
References
- cve-coordination@incibe.es (patch)