CNNVD-202512-2671 Information
Dec 15, 2025
cve
CNNVD ID
CNNVD-202512-2671
Related CVE
- CNNVD Published: 2025-12-15
Description (Chinese)
ERPNext是印度ERPNext公司的一套开源的企业资源计划解决方案。 ERPNext 15.89.0及之前版本存在安全漏洞，该漏洞源于get_dunning_letter_text方法中存在服务器端模板注入，可能导致服务器端代码执行和数据库信息泄露。
Description (English)
ERPNext is an open-source enterprise resource plan solution for ERPNext in India. ERPNext 15.89.0 and previous versions contain a security loophole, which stems from the injection of server-end templates in the Get danning letter text method, which may result in server-end code implementation and database information leaking.
Hazard Level
High
Vulnerability Type
其他
Affected Vendor
ERPNext
Published
2025-12-15
Last Modified
2026-02-24
References
https://iamanc.github.io/post/erpnext-ssti-bug-1 https://www.notion.so/SSTI-bug-1-239e6086eadc8096bfcfe90551a3a483?source=copy_link https://access.redhat.com/security/cve/cve-2025-66434
Patch
https://github.com/frappe/erpnext/releases
Share on: