CVE-2026-29081CWE-89

Frappe: Possibility of SQL Injection due to improper fieldname sanitization

Medium · published March 5, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and 15.100.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-05T20:23Z
EPSS history
Timeline
  • 05 MAR 20:23Z
    Frappe: Possibility of SQL Injection due to improper fieldname sanitization
    cvelistv5