SQL Injection Vulnerability in Frappe CRM by Frappe

CVE-2025-11461

What is CVE-2025-11461?

The Frappe CRM Dashboard Controller is susceptible to multiple SQL injection vulnerabilities due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. Attackers could exploit this flaw to execute arbitrary SQL queries, potentially compromising the integrity and confidentiality of the database. Affected version: Frappe CRM 1.53.1. It's crucial for users to apply patches and ensure their applications are secured against such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References