TI-2025-08561 Aliases CVE-2025-9339 GHSA-v2v4-h7pw-r8p3

SQL Injection in SIMPLE.ERP

LOW 31CWE-89Published 2025-10-21 · Updated 2025-10-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection
Confidentiality · integrity · availability: None · Low · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6 characters. We weren't able to identify a way to exfiltrate data within query character limit. This issue affects SIMPLE.ERP in versions before [email protected].

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00281 20th percentileScored 2026-11-07

Fix Fixed SIMPLE.ERP (Simple SA): [email protected]

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Simple SA	SIMPLE.ERP	before [email protected]	[email protected]	Patch available	CNA

SIMPLE.ERP VendorSimple SA Affected before [email protected] Fixed in [email protected] Patch available CNA

Remediation

Fix · CNA SIMPLE.ERP (Simple SA) Fixed in [email protected]

Timeline

2026-10-02 Threatist record created from CVE-2025-9339
2026-10-03 Alias added: GHSA-v2v4-h7pw-r8p3

References

Advisory 1

https://cert.pl/en/posts/2025/10/CVE-2025-9339/

Other 1

https://simple.com.pl/

TI-2026-27138 Server-Side Template Injection (SSTI) in Wirtualna Uczelnia CVSS 4.0CRITICAL 9.3
TI-2025-11134 RCE in Wirtualna Uczelnia CVSS 4.0CRITICAL 9.3
TI-2026-00925 SQL Injection in SIMPLE.ERP CVSS 4.0HIGH 8.6
TI-2024-08140 Privilege Escalation in SIMPLE.ERP CVSS 4.0HIGH 7.7
TI-2024-08139 Protocol Downgrade in SIMPLE.ERP CVSS 4.0HIGH 8.3
TI-2019-05993 The Simple - Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for… CVSS 3.0MEDIUM 6.8

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences