high8.1Public exploit code
CVE-2025-28062
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery (CSRF)2025-05-06 · webapps · python
Impact
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Frappe | Erpnext | Versions 14.74.3, 14.82.1 |