What’s Vulnerable › Vulnerabilities

CVE-2025-58375: Frappe has potential SQL Injection due to missing validation

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-06 · updated 2026-09-08
• Weakness: CWE-89

Description

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.

Affected products

• frappe: before 14.96.10; from 15.0.0, < 15.72.0

References

• https://github.com/frappe/frappe/commit/2dab009c8b15e29aa14bcd421eee8c6b2dc0fce6
• https://github.com/frappe/frappe/commit/ec70383ef0196d7b64fcf51b230483dac095a68b
• https://github.com/frappe/frappe/security/advisories/GHSA-mggw-6xqj-rphj

Get alerted when CVE-2025-58375 or the next vulnerability affects your stack