Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Frappe Framework: SQL Injection Risk via API Parameter

CVE-2025-56380 · published 1 year ago
Summary

A vulnerability in the Frappe Framework allows attackers to inject malicious SQL code, potentially giving them access to sensitive data. This affects the Frappe Framework API, which is used by many applications. Update to the latest version of Frappe Framework to protect your data.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
frappe erpnext 15.67.0
cpe:2.3:a:frappe:erpnext:15.67.0:*:*:*:*:*:*:*
frappe frappe 15.72.4
cpe:2.3:a:frappe:frappe:15.72.4:*:*:*:*:*:*:*
Original advisory text
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname param...
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published2 Oct 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-56380 · NVD
CVE-2025-56380 · OSV
Track software like this
Free during beta