CVE-2025-71431 — Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LD…
Published: 2026-10-12 · CVSS: 6.3 · CVSS 4.0
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7