CVE-2025-55731

EUVD-2025-25331
Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
Affected Products (NVD)
VendorProductVersion
frappefrappe
𝑥
< 14.96.15
frappefrappe
15.0.0 ≤
𝑥
< 15.74.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/frappe/frappe/commit/93ee30c638bf7a7e33e2937a0adccac14c38b410
https://github.com/frappe/frappe/commit/c2b01e3eb6f50e9bd05df0440f5cbf5dfbc1badd
https://github.com/frappe/frappe/security/advisories/GHSA-5p8f-568f-vfq2