CVE-2017-1000120

2017-10-0501:29:04

Google

osv.dev

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

43.0%

JSON

[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.

References

tech.mantz-it.com/2016/12/sql-injection-in-frappe-framework.html