CVE-2025-58375

EUVD-2025-27054
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 26.94%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
frappefrappe
𝑥
< 14.96.10
CNA
Common Weakness Enumeration
References
https://github.com/frappe/frappe/commit/2dab009c8b15e29aa14bcd421eee8c6b2dc0fce6
https://github.com/frappe/frappe/commit/ec70383ef0196d7b64fcf51b230483dac095a68b
https://github.com/frappe/frappe/security/advisories/GHSA-mggw-6xqj-rphj