CVE-2025-52048

The Frappe web development framework (versions 15.x.x before 15.72.0 and 14.x.x before 14.96.10 ) is vulnerable to SQL Injection in the add_tag() function located at frappe/desk/doctype/tag/tag.py. An attacker can exploit this by injecting a malicious SQL query into the dt parameter to extract in...