CVE-2025-58375 — Frappe has potential SQL Injection due to missing validation
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQ…
Published: 2026-08-07 · CVSS: 8.1 · CVSS 3.1
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7