CVE-2026-32954

HIGH

7.1

Descripcion

ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0.

Detalles CVE

Puntuacion CVSS v3.17.1

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado3/20/2026

Ultima modificacion3/23/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

frappe:erpnext

Debilidades (CWE)

CWE-89

Referencias

https://github.com/frappe/erpnext/releases/tag/v15.100.0(security-advisories@github.com)

https://github.com/frappe/erpnext/releases/tag/v16.8.0(security-advisories@github.com)

https://github.com/frappe/erpnext/security/advisories/GHSA-j669-ghv2-gmqg(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.