SQL Injection

Every one of the 57 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Frappe SQL Injection from reporting logicCVE-2024-24813frappe · CVSS 7.5 · 0.6% likely

   CWE-89

2. Frappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_dataCVE-2025-10655Frappe · CVSS 8.6 · 0.6% likely

   CWE-89

3. Frappe: check_safe_sql_query Permits SELECT INTO OUTFILECVE-2026-47199frappe · CVSS 2.3 · 0.5% likely

   CWE-89

4. ERPNext: Possibility of SQL injection due to missing validationCVE-2026-72908frappe · CVSS 6.5 · 0.5% likely

   CWE-89

5. Possibility limited SQL injection due to insufficient validation in FrappeCVE-2023-41328frappe · CVSS 4.2 · 0.5% likely

   CWE-89

6. Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode ReportCVE-2026-54524frappe · CVSS 7.1 · 0.5% likely

   CWE-89

7. ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filterCVE-2026-65822frappe · CVSS 7.6 · 0.5% likely

   CWE-89

8. Frappe has possibility of SQL injection due to improper validationsCVE-2025-30212frappe · CVSS 6.6 · 0.4% likely

   CWE-89

9. Frappe possibility of SQL injection due to improper validationsCVE-2025-52895frappe · CVSS 8.7 · 0.4% likely

   CWE-89

10. Frappe has the possibility of Authenticated SQL Injection due to improper validationsCVE-2025-55731frappe · CVSS 6.3 · 0.4% likely

    CWE-89

11. Frappe LMS SQL Injection Issue on People PageCVE-2023-42807frappe · CVSS 6.3 · 0.4% likely

    CWE-89

12. In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from dat…CVE-2025-52044Frappe · CVSS 7.5 · 0.4% likely

    CWE-89

13. Frappe has potential SQL Injection due to missing validationCVE-2025-58375frappe · CVSS 8.1 · 0.4% likely

    CWE-89

14. An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext/accounts/doctype/payment_entry/payment_entry.py is vulnerable…CVE-2025-66440Frappe · CVSS 9.8 · 0.4% likely

    CWE-89

15. An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_entry.py is vulnerable…CVE-2025-66439Frappe · CVSS 9.8 · 0.4% likely

    CWE-89

16. Frappe CRM 1.53.1 — Multiple SQL Injections in Dashboard ControllerCVE-2025-11461Frappe · CVSS 7.1 · 0.4% likely

    CWE-89

17. Frappe has possibility of SQL injection due to improper validationsCVE-2025-30217frappe · CVSS 6.6 · 0.4% likely

    CWE-89

18. SQL Injection in Frappe's ERPNextCVE-2026-12895Frappe · CVSS 7.1 · 0.4% likely

    CWE-89

19. Frappe: Possibility of SQL injection in reportviewCVE-2026-55823frappe · CVSS 8.7 · 0.4% likely

    CWE-89

20. Frappe has the possibility of SQL Injection due to improper validationsCVE-2025-55732frappe · CVSS 8.7 · 0.4% likely

    CWE-89

21. ERP: Possibility of SQL injection due to missing validationCVE-2025-58439frappe · CVSS 8.1 · 0.3% likely

    CWE-89

22. In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows…CVE-2025-52041Frappe · CVSS 8.2 · 0.3% likely

    CWE-89

23. In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, whi…CVE-2025-52039Frappe · CVSS 8.2 · 0.3% likely

    CWE-89

24. Frappe ERPNext before 16.6.0 SQL Injection via Missing Input ValidationCVE-2026-109674frappe · CVSS 6.5 · 0.3% likely

    CWE-89

25. Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint ParametersCVE-2026-109663frappe · CVSS 6.5 · 0.3% likely

    CWE-89

26. Frappe has the possibility of SQL Injection due to improper validationsCVE-2025-66205frappe · CVSS 7.1 · 0.3% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.