Vulnerability · Published Aug 7, 2026 · Assigned by GitHub_M

CVE-2025-58375Frappe has potential SQL Injection due to missing validation

High 8.1

In plain English

A high-severity SQL injection in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 67.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.

Affected products (as reported)

Vendor	Product	Versions
frappe	frappe	< 14.96.10>= 15.0.0, < 15.72.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/frappe/frappe/security/advisories/GHSA-mggw-6xqj-rphj x_refsource_CONFIRM
https://github.com/frappe/frappe/commit/2dab009c8b15e29aa14bcd421eee8c6b2dc0fce6 x_refsource_MISC
https://github.com/frappe/frappe/commit/ec70383ef0196d7b64fcf51b230483dac095a68b x_refsource_MISC