What’s Vulnerable › Vulnerabilities

CVE-2025-9339: SQL Injection in SIMPLE.ERP

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-21 · updated 2026-10-08
• Weakness: CWE-89

Description

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6 characters. We weren't able to identify a way to exfiltrate data within query character limit. This issue affects SIMPLE.ERP in versions before 6.30@a04.3.

Affected products

• Simple SA SIMPLE.ERP: before 6.30@a04.3 — fixed in 6.30@a04.3

How to fix

Upgrade to a fixed version: Simple SA SIMPLE.ERP 6.30@a04.3. Check the vendor advisory for mitigations.

References

• https://cert.pl/en/posts/2025/10/CVE-2025-9339/
• https://simple.com.pl/

Get alerted when CVE-2025-9339 or the next vulnerability affects your stack