CVE-2025-55731

Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub_MCNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
VendorProductVersion
frappefrappe
𝑥
< 14.96.15
frappefrappe
15.0.0 ≤
𝑥
< 15.74.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/frappe/frappe/commit/93ee30c638bf7a7e33e2937a0adccac14c38b410
https://github.com/frappe/frappe/commit/c2b01e3eb6f50e9bd05df0440f5cbf5dfbc1badd
https://github.com/frappe/frappe/security/advisories/GHSA-5p8f-568f-vfq2