Vulnerability Database

299,584

Total vulnerabilities in the database

CVE-2025-28062

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.

Published: May 5, 2025
Updated: Jun 18, 2025
CVE: CVE-2025-28062
Exploit:

No technical information available.

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
frappe / erpnext	14.74.3	14.74.3.x
frappe / erpnext	14.82.1	14.82.1.x

https://github.com/frappe/erpnext
https://github.com/Thvt0ne/CVE-2025-28062

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo