Vulnerability · Published Aug 20, 2025 · Assigned by GitHub_M

CVE-2025-55731Frappe has the possibility of Authenticated SQL Injection due to improper validations

Medium 6.3

In plain English

A medium-severity SQL injection in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.4%top 67.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.

Affected products (as reported)

Vendor	Product	Versions
frappe	frappe	< 14.96.15>= 15.0.0, < 15.74.2

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

https://github.com/frappe/frappe/security/advisories/GHSA-5p8f-568f-vfq2 x_refsource_CONFIRM
https://github.com/frappe/frappe/commit/93ee30c638bf7a7e33e2937a0adccac14c38b410 x_refsource_MISC
https://github.com/frappe/frappe/commit/c2b01e3eb6f50e9bd05df0440f5cbf5dfbc1badd x_refsource_MISC