Medium · 6.3 CVE-2025-55731 EUVD-2025-25331

Frappe has the possibility of Authenticated SQL Injection due to improper validations

Published Aug 20, 2025 · Updated Aug 20, 2025 · Assigned by GitHub_M

Vendor: Frappe Technologies Product: frappe

Description

Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.

Affected products

Vendor	Product	Affected	Fixed
frappe	frappe	< 14.96.15, >= 15.0.0, < 15.74.2	—

References

https://github.com/frappe/frappe/security/advisories/GHSA-5p8f-568f-vfq2
https://github.com/frappe/frappe/commit/93ee30c638bf7a7e33e2937a0adccac14c38b410
https://github.com/frappe/frappe/commit/c2b01e3eb6f50e9bd05df0440f5cbf5dfbc1badd