SQL Injection Vulnerability in Frappe Framework Versions 14.96.9 and Below
CVE-2025-58375
8.1HIGH
What is CVE-2025-58375?
The Frappe Framework suffers from a serious security flaw due to an insecure endpoint parameter, which is susceptible to error-based SQL Injection. This vulnerability affects versions 14.96.9 and earlier as well as versions 15.0.0 through 15.71.0. Attackers can exploit this weakness to retrieve sensitive information, such as internal versioning details, through the lack of adequate input validation. The issue has been addressed in versions 14.96.10 and 15.72.0, emphasizing the importance of updating to secure systems against potential data breaches.
Affected Version(s)
frappe < 14.96.10 < 14.96.10
frappe >= 15.0.0, < 15.72.0 < 15.0.0, 15.72.0