Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
frappe frappe affected
Version Status Constraints
< 14.96.10 affected —
>= 15.0.0, < 15.72.0 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-27054 This CVE is a duplicate of another CVE.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/frappe/frappe/commit/2dab009c8b15e29aa14bcd421eee8c6b2dc0fce6 cve-icon
https://github.com/frappe/frappe/commit/ec70383ef0196d7b64fcf51b230483dac095a68b cve-icon
https://github.com/frappe/frappe/security/advisories/GHSA-mggw-6xqj-rphj cve-icon
History

Fri, 07 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Description This CVE is a duplicate of another CVE. Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.
Title Frappe has potential SQL Injection due to missing validation
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Sat, 06 Sep 2025 00:00:00 +0000

Type Values Removed Values Added
Description This CVE is a duplicate of another CVE.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-07T18:21:10.445Z

Reserved: 2025-08-29T16:19:59.012Z

Link: CVE-2025-58375

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Rejected

Published: 2025-09-06T00:15:35.047

Modified: 2025-09-06T00:15:35.047

Link: CVE-2025-58375

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses