CVE-2025-52895

HIGH

frappe < 14.94.3 - SQL Injection via Specially Crafted Request

Title source: llm
STIX 2.1

Description

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for this issue other than upgrading.

References (4)

Core 4

Scores

CVSS v3 7.5
EPSS 0.0035
EPSS Percentile 26.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
frappe/frappe < 14.94.3
Published Jun 30, 2025
Tracked Since Feb 18, 2026