CVE-2025-66205
7.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Summary
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| frappe | frappe | >= 15.0.0, < 15.86.0 | affected |
| frappe | frappe | < 14.99.2 | affected |
Weaknesses
- CWE-89: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://github.com/frappe/frappe/security/advisories/GHSA-mp93-8vxr-hqq9
- https://github.com/frappe/frappe/commit/984c641bff9539b6126a01146096f133db6a955b
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.