CVE-2025-66205
01.12.2025, 21:15
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.
| Vendor | Product | Version |
|---|---|---|
| frappe | frappe | 𝑥 < 14.99.2 |
| frappe | frappe | 15.0.0 ≤ 𝑥 < 15.86.0 |
𝑥
= Vulnerable software versions