AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-72908

MEDIUM · CVSS 6.5 EPSS 0.29% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The get_tax_template function in ERPNext versions prior to 15.109.0 and 16.20.0 is vulnerable to SQL injection due to improper handling of user-supplied input in constructing SQL queries. This flaw allows authenticated low-privilege users to manipulate the SQL WHERE clause, potentially leading to the extraction of sensitive information from the database. Organizations using affected versions should prioritize upgrading to the patched versions to mitigate the risk of data exposure.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-72908
Severity
MEDIUM
CVSS
6.5
EPSS
0.29%

Original NVD Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.