EUVD-2025-32134

Malicious code in bioql PyPI...

CVE-2025-56380

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...

CVE-2025-56380

The Frappe Framework (v15.72.4) and ERPNext (v15.67.0) contain a time-based blind SQL injection vulnerability (CWE-89) in the frappe.client.get_value API endpoint. The root cause is the lack of proper validation for the fieldname parameter, which is directly concatenated into the SQL query. An au...