CVE-2026-32954

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32954", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T00:05:53.285Z", "datePublished": "2026-03-20T04:30:26.360Z", "dateUpdated": "2026-03-20T14:27:42.195Z"}, "containers": {"cna": {"title": "ERP has a possibility SQL Injection vulnerability due to missing validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-j669-ghv2-gmqg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-j669-ghv2-gmqg"}, {"name": "https://github.com/frappe/erpnext/releases/tag/v15.100.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/frappe/erpnext/releases/tag/v15.100.0"}, {"name": "https://github.com/frappe/erpnext/releases/tag/v16.8.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/frappe/erpnext/releases/tag/v16.8.0"}], "affected": [{"vendor": "frappe", "product": "erpnext", "versions": [{"version": ">= 16.0.0-beta.1, < 16.8.0", "status": "affected"}, {"version": "< 15.100.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T04:30:26.360Z"}, "descriptions": [{"lang": "en", "value": "ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0."}], "source": {"advisory": "GHSA-j669-ghv2-gmqg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T14:27:19.403978Z", "id": "CVE-2026-32954", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T14:27:42.195Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32954", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T14:27:19.403978Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T14:27:38.972Z"}}], "cna": {"title": "ERP has a possibility SQL Injection vulnerability due to missing validation", "source": {"advisory": "GHSA-j669-ghv2-gmqg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "frappe", "product": "erpnext", "versions": [{"status": "affected", "version": ">= 16.0.0-beta.1, < 16.8.0"}, {"status": "affected", "version": "< 15.100.0"}]}], "references": [{"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-j669-ghv2-gmqg", "name": "https://github.com/frappe/erpnext/security/advisories/GHSA-j669-ghv2-gmqg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/frappe/erpnext/releases/tag/v15.100.0", "name": "https://github.com/frappe/erpnext/releases/tag/v15.100.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/frappe/erpnext/releases/tag/v16.8.0", "name": "https://github.com/frappe/erpnext/releases/tag/v16.8.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T04:30:26.360Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32954", "state": "PUBLISHED", "dateUpdated": "2026-03-20T14:27:42.195Z", "dateReserved": "2026-03-17T00:05:53.285Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T04:30:26.360Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "erpnext", "vendor": "frappe", "versions": [{"status": "affected", "version": ">= 16.0.0-beta.1, < 16.8.0"}, {"status": "affected", "version": "< 15.100.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B113C66-E9D4-4F22-9D5B-D2A9538B6D1B", "versionEndExcluding": "15.100.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DBAE940-BDCC-4903-852F-AFD98566B150", "versionEndExcluding": "16.8.0", "versionStartIncluding": "16.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0."}, {"lang": "es", "value": "ERP es una herramienta de Planificaci\u00f3n de Recursos Empresariales de c\u00f3digo abierto y gratuita. En versiones anteriores a la 16.8.0 y la 15.100.0, ciertos puntos finales eran vulnerables a inyecci\u00f3n SQL ciega basada en tiempo y basada en booleanos debido a una validaci\u00f3n de par\u00e1metros insuficiente, permitiendo a los atacantes inferir informaci\u00f3n de la base de datos. Este problema ha sido solucionado en las versiones 15.100.0 y 16.8.0."}], "id": "CVE-2026-32954", "lastModified": "2026-06-17T10:36:37.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32954", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T14:27:19.403978Z", "version": "2.0.3"}}]}, "published": "2026-03-20T05:16:14.877", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/frappe/erpnext/releases/tag/v15.100.0"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/frappe/erpnext/releases/tag/v16.8.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-j669-ghv2-gmqg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[16.0.0-beta.1,16.8.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,15.100.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "erpnext", "source": "cna", "vendor": "frappe"}, "product": "erpnext", "vendor": "frappe"}], "analysis": {"en": {"generated_at": "2026-03-23T20:27:41.520419+00:00", "value": {"mitigation_remediation": ["Upgrade ERPNext to version 15.100.0 or later; the issue is fixed starting in 15.100.0 and 16.8.0. ", "Verify that the system is running a patched release by checking the version number in the ERPNext application dashboard or via the command line. ", "If upgrading is not immediately possible, limit network exposure by restricting external access to the ERPNext endpoints and applying strict firewall rules. ", "Stay informed by monitoring the ERPNext security advisories page and review any additional patches or updates released by the community."], "summary": {"action": "Patch Now", "impact": "Information disclosure via blind SQL injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the ERPNext platform, a free and open source enterprise resource planning system. Versions prior to 16.8.0 and 15.100.0 are identified as vulnerable. These versions were released before the patch that addressed the input\u2011validation flaw. System administrators managing older ERPNext deployments should verify the installed releases and confirm they are below the specified thresholds.", "description_and_impact": "Certain endpoints in the ERPNext application allow attackers to perform time\u2011based and boolean\u2011based blind SQL injection due to insufficient input validation. By sending crafted queries, an adversary can infer sensitive database contents without receiving direct responses. The principal consequence is the unintended disclosure of confidential data, which can lead to credential theft, corporate espionage, or further privilege escalation. The weakness aligns with CWE\u201189, a classic injection flaw that enables data leakage and may serve as a foothold for additional attacks.", "risk_and_exploitability": "The CVSS score of 7.1 indicates a high severity, reflecting the potential for significant data exposure. The EPSS score of less than 1% suggests that, at present, exploitation is unlikely, and the vulnerability is not part of the recognized exploited catalog. Nonetheless, the ability to infer arbitrary database information presents a serious risk, especially in environments where ERPNext stores sensitive financial or HR data. Exploitation requires network access to the vulnerable endpoints and the ability to craft input strings, meaning that attackers can likely conduct the attack remotely without additional privileges."}}}}, "created": "2026-03-20T08:52:39.040862+00:00", "updated": "2026-03-25T14:09:19.614133+00:00", "vendors": ["frappe", "frappe$PRODUCT$erpnext"]}