CVE-2025-71431

EUVD-2025-211073
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
LDAP Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.13%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
frappefrappe
𝑥
< 14.99.2
CNA
frappefrappe
15.0.0 ≤
𝑥
< 15.86.0
CNA
Common Weakness Enumeration
References
https://github.com/frappe/frappe/security/advisories/GHSA-qrq5-v93p-8xhw
https://www.vulncheck.com/advisories/frappe-before-15.86.0-ldap-injection-via-unsanitized-endpoint-parameters