CVE-2017-1000120

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-05 · updated 2026-06-17
Weakness: CWE-89

Description

[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.

Affected products

frappe: through 7.1.27

References

http://tech.mantz-it.com/2016/12/sql-injection-in-frappe-framework.html
http://tech.mantz-it.com/2016/12/sql-injection-in-frappe-framework.html

Get alerted when CVE-2017-1000120 or the next vulnerability affects your stack