« Volver al listado

CVE-2026-72908

Estado: AplazadaMedia (6.5)—

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Frappe — ErpnextAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72908",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-72908",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-12T22:08:04.272198Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "frappe",
          "product": "erpnext",
          "versions": [
            {
              "status": "affected",
              "version": "< 15.109.0"
            },
            {
              "status": "affected",
              "version": ">= 16.0.0, < 16.20.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-10T21:17:25.593",
  "references": [
    {
      "url": "https://github.com/frappe/erpnext/commit/2a91c7229a47ac6a5bb2d8227290b03415bf8baf",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/frappe/erpnext/commit/c45d2a348777a9bdf697832b6ca129d2f0626fd2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/frappe/erpnext/commit/f98975f51a62d611f536368671c3dbaf81d61eb9",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/frappe/erpnext/pull/55127",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/frappe/erpnext/releases/tag/v15.109.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/frappe/erpnext/releases/tag/v16.20.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-grhp-m55m-63f8",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0."
    }
  ],
  "lastModified": "2026-09-08T20:54:37.790",
  "sourceIdentifier": "security-advisories@github.com"
}