CVE-2026-12895

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12895", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2026-06-22T12:58:30.777Z", "datePublished": "2026-07-29T10:58:50.322Z", "dateUpdated": "2026-07-29T12:07:55.509Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-07-29T10:58:50.322Z"}, "title": "SQL Injection in Frappe's ERPNext", "datePublic": "2026-07-29T10:53:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "type": "CWE"}]}], "affected": [{"vendor": "Frappe", "product": "ERPNext", "versions": [{"status": "affected", "version": "0", "lessThan": "15.111.0", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "16.22.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe\u2019s access restrictions (DocPerm), extract confidential information from the database\u2014including fragments of the administrator\u2019s password hash\u2014and access other sensitive data, such as credentials, integration tokens, or financial information.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe\u2019s access restrictions (DocPerm), extract confidential information from the database\u2014including fragments of the administrator\u2019s password hash\u2014and access other sensitive data, such as credentials, integration tokens, or financial information."}]}], "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-frappes-erpnext", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "The vulnerability has been fixed by the Frappe team in versions 15.111.0 and 16.22.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The vulnerability has been fixed by the Frappe team in versions 15.111.0 and 16.22.0."}]}], "credits": [{"lang": "en", "value": "Alejandro Ramos", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T12:07:25.492403Z", "id": "CVE-2026-12895", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T12:07:55.509Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12895", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T12:07:25.492403Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T12:07:48.249Z"}}], "cna": {"title": "SQL Injection in Frappe's ERPNext", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alejandro Ramos"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Frappe", "product": "ERPNext", "versions": [{"status": "affected", "version": "0", "lessThan": "15.111.0", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "16.22.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vulnerability has been fixed by the Frappe team in versions 15.111.0 and 16.22.0.", "supportingMedia": [{"type": "text/html", "value": "The vulnerability has been fixed by the Frappe team in versions 15.111.0 and 16.22.0.", "base64": false}]}], "datePublic": "2026-07-29T10:53:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-frappes-erpnext", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe\u2019s access restrictions (DocPerm), extract confidential information from the database\u2014including fragments of the administrator\u2019s password hash\u2014and access other sensitive data, such as credentials, integration tokens, or financial information.", "supportingMedia": [{"type": "text/html", "value": "SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe\u2019s access restrictions (DocPerm), extract confidential information from the database\u2014including fragments of the administrator\u2019s password hash\u2014and access other sensitive data, such as credentials, integration tokens, or financial information.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-07-29T10:58:50.322Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12895", "state": "PUBLISHED", "dateUpdated": "2026-07-29T12:07:55.509Z", "dateReserved": "2026-06-22T12:58:30.777Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2026-07-29T10:58:50.322Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ERPNext", "vendor": "Frappe", "versions": [{"lessThan": "15.111.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "16.22.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve-coordination@incibe.es"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe\u2019s access restrictions (DocPerm), extract confidential information from the database\u2014including fragments of the administrator\u2019s password hash\u2014and access other sensitive data, such as credentials, integration tokens, or financial information."}, {"lang": "es", "value": "Inyecci\u00f3n SQL en ERPNext de Frappe, versiones ERPNext 15.107.0 y Frappe 15.107.2. La aplicaci\u00f3n construye consultas SQL mediante interpolaci\u00f3n directa de cadenas usando \u2019str.format()\u2019 sin emplear consultas parametrizadas, permitiendo que el nombre (docname) de un registro de Proveedor que contiene metacaracteres SQL sea interpretado como parte de la consulta. La explotaci\u00f3n de esta vulnerabilidad podr\u00eda permitir a un usuario autenticado con bajos privilegios ejecutar consultas SQL arbitrarias, eludir las restricciones de acceso de Frappe (DocPerm), extraer informaci\u00f3n confidencial de la base de datos -incluyendo fragmentos del hash de la contrase\u00f1a del administrador- y acceder a otros datos sensibles, como credenciales, tokens de integraci\u00f3n o informaci\u00f3n financiera."}], "id": "CVE-2026-12895", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@incibe.es", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12895", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T12:07:25.492403Z", "version": "2.0.3"}}]}, "published": "2026-07-29T11:16:47.227", "references": [{"source": "cve-coordination@incibe.es", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-frappes-erpnext"}], "sourceIdentifier": "cve-coordination@incibe.es", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "cve-coordination@incibe.es", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,15.111.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,16.22.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ERPNext", "source": "cna", "vendor": "Frappe"}, "product": "erpnext", "vendor": "frappe"}], "created": "2026-07-29T12:30:03.544784+00:00", "updated": "2026-08-03T13:30:04.544224+00:00", "vendors": ["frappe", "frappe$PRODUCT$erpnext"]}