CVE-2025-9339CWE-89sql-injection

CVE-2025-9339

published October 21, 2025

CVSS
7.1
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6 characters. We weren't able to identify a way to exfiltrate data within query character limit.

This issue affects SIMPLE.ERP in versions before [email protected].

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-10-21T18:15Z
References (2)
https://cert.pl/en/posts/2025/10/CVE-2025-9339/ · [email protected]https://simple.com.pl/ · [email protected]
EPSS history
Timeline
  • 21 OCT 13:34Z
    SQL Injection in SIMPLE.ERP
    cvelistv5