Log in Start free

Vulnerability · Published Aug 17, 2026 · Assigned by GitHub_M

CVE-2026-65822ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

High 7.6

In plain English

A high-severity SQL injection in erpnext from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.5%top 59.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.

Affected products (as reported)

VendorProductVersions
frappe erpnext < 15.116.0>= 16.0.0, < 16.23.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References