CVE-2025-58375

Frappe (full-stack web framework) is affected by an insecure endpoint parameter enabling error-based SQL injection in versions 14.96.9 and earlier, and 15.0.0–15.71.0, due to lack of input validation. Impact includes potential retrieval of sensitive information (e.g., versioning). Remediation: up...

CVE-2025-58375 Frappe has potential SQL Injection due to missing validation

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed i...