CVE-2025-58375CWE-89sql-injection

CVE-2025-58375

High · published September 6, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-09-06T04:15Z
References (3)
https://github.com/frappe/frappe/commit/2dab009c8b15e29aa14bcd421eee8c6b2dc0fce6 · [email protected]https://github.com/frappe/frappe/commit/ec70383ef0196d7b64fcf51b230483dac095a68b · [email protected]https://github.com/frappe/frappe/security/advisories/GHSA-mggw-6xqj-rphj · [email protected]
EPSS history
Timeline
  • 07 AUG 18:21Z
    Frappe has potential SQL Injection due to missing validation
    cvelistv5