Read the docs
TI-2018-14222 Aliases CVE-2018-20061GHSA-66f4-g2vx-q58x

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29.

Priority LOW 36CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.

Why it matters now

EPSS 0.01433 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*10.0.0 – 10.1.76; 11.0.0 to before 11.0.3Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:*11.0.3 beta10Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:*11.0.3 beta11Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:*11.0.3 beta12Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:*11.0.3 beta13Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:*11.0.3 beta14Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:*11.0.3 beta15Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:*11.0.3 beta16Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:*11.0.3 beta17Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:*11.0.3 beta18Vulnerablefrappe
  • cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* Versions 10.0.0 – 10.1.76; 11.0.0 to before 11.0.3 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:* Versions 11.0.3 beta10 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:* Versions 11.0.3 beta11 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:* Versions 11.0.3 beta12 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:* Versions 11.0.3 beta13 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:* Versions 11.0.3 beta14 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:* Versions 11.0.3 beta15 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:* Versions 11.0.3 beta16 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:* Versions 11.0.3 beta17 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:* Versions 11.0.3 beta18 Vulnerable ·frappe
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:*11.0.3 beta19Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:*11.0.3 beta2Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:*11.0.3 beta20Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:*11.0.3 beta21Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:*11.0.3 beta22Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:*11.0.3 beta23Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:*11.0.3 beta24Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:*11.0.3 beta25Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:*11.0.3 beta26Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:*11.0.3 beta27Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:*11.0.3 beta28Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:*11.0.3 beta29Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:*11.0.3 beta3Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:*11.0.3 beta4Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:*11.0.3 beta5Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*11.0.3 beta6Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:*11.0.3 beta7Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:*11.0.3 beta8Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:*11.0.3 beta9Vulnerablefrappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:* Versions 11.0.3 beta19 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:* Versions 11.0.3 beta2 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:* Versions 11.0.3 beta20 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:* Versions 11.0.3 beta21 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:* Versions 11.0.3 beta22 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:* Versions 11.0.3 beta23 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:* Versions 11.0.3 beta24 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:* Versions 11.0.3 beta25 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:* Versions 11.0.3 beta26 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:* Versions 11.0.3 beta27 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:* Versions 11.0.3 beta28 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:* Versions 11.0.3 beta29 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:* Versions 11.0.3 beta3 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:* Versions 11.0.3 beta4 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:* Versions 11.0.3 beta5 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:* Versions 11.0.3 beta6 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:* Versions 11.0.3 beta7 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:* Versions 11.0.3 beta8 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:* Versions 11.0.3 beta9 Vulnerable ·frappe

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-20061
  2. 2026-10-03 Alias added: GHSA-66f4-g2vx-q58x

References

Advisory 1

  • TI-2026-28140 ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). CVSS 3.1CRITICAL 9.8
  • TI-2025-40873 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
  • TI-2025-40872 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
  • TI-2025-40871 A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext… CVSS 3.1CRITICAL 9.8
  • TI-2025-32462 In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at… CVSS 3.1HIGH 8.2
  • TI-2025-32461 In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at… CVSS 3.1HIGH 8.2
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences