CVE-2025-28062 Cross-site request forgery in n/a
Attackers can perform unauthorized actions like user deletion and privilege escalation in ERPNext due to missing CSRF protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-28062?
CVE-2025-28062 is a high-severity vulnerability in Frappe Erpnext, published on 5 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.
Weakness: CWE-352
Which versions are affected by CVE-2025-28062?
It affects 1 product.
Products include Frappe Erpnext.
How do I fix CVE-2025-28062?
No fix has been published for CVE-2025-28062 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-28062 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-28062 exists.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in Frappe Erpnext
Sources
Also known as GHSA-v248-84wv-hjm5.