Vulnerabilities CVE-2026-65822

CVE-2026-65822

High

Open

TLP:CLEAR

ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.

Details

CVSS Score: 7.6
EPSS Score ⓘ: 0.26%

18.3th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Confidence: 90%
Published: Aug 17, 2026
Last Modified: Aug 18, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.