High · 8.6 CVE-2025-10655 EUVD-2025-201950GHSA-8cv9-4g7x-5c7f

Frappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_data

Published Dec 9, 2025 · Updated Dec 9, 2025 · Assigned by Fluid Attacks

Vendor: Frappe Technologies Product: Frappe HelpDesk

Description

SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.

Affected products

Vendor	Product	Affected	Fixed
Frappe	Frappe HelpDesk	1.14.0	—

References

https://fluidattacks.com/advisories/dyango third-party-advisory
https://github.com/frappe/helpdesk product
https://github.com/frappe/helpdesk/pull/2795 patch