CVE-2025-55731

Frappe has the possibility of Authenticated SQL Injection due to improper validations

CVSS 6.3 MEDIUMEPSS 0.3%CWE-89

Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Affected products

frappe · frappe

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/frappe/frappe/commit/93ee30c638bf7a7e33e2937a0adccac14c38b410 https://github.com/frappe/frappe/commit/c2b01e3eb6f50e9bd05df0440f5cbf5dfbc1badd https://github.com/frappe/frappe/security/advisories/GHSA-5p8f-568f-vfq2