CVE-2025-58439: Frappe Erpnext

Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days.

ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retrieved. This issue is fixed in versions 14.89.2 and 15.76.0.

Affected products

• Frappe Erpnext: before 14.89.2 (fixed in 14.89.2); from 15.0.0, before 15.76.0 (fixed in 15.76.0)

Published 2025-09-06. Last modified 2026-06-17.