CVE-2025-56380

CVE-2025-56380 — Time-based Blind SQL Injection in Frappe / ERPNext frappe.client.getvalue 📌 Summary A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework v15.72.4 and present in ERPNext v15.67.0 codebase. An authenticated use...

CVE-2025-71456

A flaw was found in vtenext. A Structured Query Language SQL injection vulnerability exists in the Fax module due to improper validation of the fieldname parameter. An authenticated remote attacker with low privileges can exploit this flaw by sending a specially crafted request to execute arbitra...

CVE-2025-71456

The vtenext software (versions before 25.02.2 ) is vulnerable to an SQL injection flaw located in the modules/Fax/EditView.php component. This vulnerability exists because the application fails to properly neutralize the fieldname parameter. Authenticated users with low privileges can exploit thi...

EUVD-2025-211254

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

PT-2026-137122

Name of the Vulnerable Software and Affected Versions vtenext versions prior to 25.02.2 Description Authenticated low-privileged users can perform an SQL injection by providing a crafted fieldname parameter to the 'modules/Fax/EditView.php' endpoint. This allows attackers to read arbitrary databa...

CVE-2021-47984 WordPress Plugin WP24 Domain Check 1.6.2 Stored XSS

WordPress Plugin WP24 Domain Check 1.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the fieldnameDomain parameter. Attackers can inject JavaScript payloads through the plugin settings form at...

CVE-2021-47984

WordPress Plugin WP24 Domain Check 1.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the fieldnameDomain parameter. Attackers can inject JavaScript payloads through the plugin settings form at...

CVE-2026-29081 Frappe: Possibility of SQL Injection due to improper fieldname sanitization

Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and...

CVE-2026-29081 Frappe: Possibility of SQL Injection due to improper fieldname sanitization

Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and...

CVE-2026-29081 Frappe: Possibility of SQL Injection due to improper fieldname sanitization

Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and...

CVE-2026-29081

Frappe CVE-2026-29081 affects the framework prior to versions 14.100.1 and 15.100.0, where an endpoint allowed SQL injection via specially crafted requests due to improper fieldname sanitization. Consequence: potential exposure of sensitive information. Fix: patched in 14.100.1 and 15.100.0. Evid...

EUVD-2018-11243

Malware in sbrugna...

EUVD-2022-6568

Malicious code in bioql PyPI...

EUVD-2025-32134

Malicious code in bioql PyPI...

CVE-2025-56380

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...

CVE-2025-56380

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...

CVE-2025-56380

The Frappe Framework (v15.72.4) and ERPNext (v15.67.0) contain a time-based blind SQL injection vulnerability (CWE-89) in the frappe.client.get_value API endpoint. The root cause is the lack of proper validation for the fieldname parameter, which is directly concatenated into the SQL query. An au...

PT-2025-40353

Name of the Vulnerable Software and Affected Versions Frappe Framework version 15.72.4 Description A SQL injection issue exists in Frappe Framework. The issue is located in the fieldname parameter of the frappe.client.get value API endpoint. A crafted script provided to the fieldname parameter ca...

Frappe Technologies Frappe Framework security vulnerabilities

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe Framework version 15.72.4, which stems from an SQL injection in the fieldnam...

📄 ERPNext 15.67.0 / Frappe 15.72.4 Blind SQL Injection

A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework version 15.72.4 and it is also present in ERPNext version 15.67.0. An authenticated user with access to the reporting/client API can inject SQL via the fieldname parameter...