What’s Vulnerable › Vulnerabilities

CVE-2025-55732: Frappe has the possibility of SQL Injection due to improper validations

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-20 · updated 2026-06-17
• Weakness: CWE-89

Description

Frappe is a full-stack web application framework. Prior to 15.74.2 and 14.96.15, an attacker could implement SQL injection through specially crafted requests, allowing malicious people to access sensitive information. This vulnerability is a bypass of the official patch released for CVE-2025-52895. This vulnerability is fixed in 15.74.2 and 14.96.15.

Affected products

• frappe: before 14.96.15; from 15.0.0 before 15.74.2 — fixed in 14.96.15, 15.74.2

How to fix

Upgrade to a fixed version: frappe 14.96.15, 15.74.2. Check the vendor advisory for mitigations.

References

• https://github.com/frappe/frappe/commit/24dd2d9420a7c68ce09875cb18586d1bf071c857
• https://github.com/frappe/frappe/commit/abe2cc25e333cd794405d12caec4da0279a54e6e
• https://github.com/frappe/frappe/security/advisories/GHSA-6rpr-2hjx-w9vp

Get alerted when CVE-2025-55732 or the next vulnerability affects your stack