CVE-2025-11461

CVE-2025-11461 affects Frappe CRM 1.53.1. The vulnerability is multiple SQL injections in the Dashboard Controller caused by unsafe concatenation of user-controlled parameters into dynamic SQL statements. Red Hat and EUVD entries confirm the same description. Connected documents do not specify a ...

PT-2025-27461 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.94.3 Frappe versions prior to 15.58.0 Description: A carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This issue can only be exploited on self-hosted...

PT-2025-27459 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.94.3 Frappe versions prior to 15.58.0 Description: The issue is related to a SQL injection vulnerability that could be achieved via a specially crafted request, potentially allowing malicious individuals to gain...

PT-2025-12809 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.91.0 and prior to 15.52.0 Description: Frappe is a full-stack web application framework. A system user could create specific documents in a manner that allows for remote code execution. Recommendations: Frappe...

PT-2024-25685 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.74.0 Frappe versions prior to 15.26.0 Description: The login page of Frappe accepts a redirect argument, allowing redirects to untrusted external URLs. This behavior can be exploited by malicious actors for phishin...

PT-2024-21653 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.66.3 Frappe versions prior to 15.16.0 Description: Frappe is a full-stack web application framework. The issue allows file permission to be bypassed using certain endpoints, granting less privileged users permissio...

PT-2022-26042 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe version 14.10.0 Description: The issue allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import file...