CVE-2025-56380

CVE-2025-56380 — Time-based Blind SQL Injection in Frappe / ERPNext frappe.client.getvalue 📌 Summary A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework v15.72.4 and present in ERPNext v15.67.0 codebase. An authenticated use...

CVE-2025-56380

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...

CVE-2025-56380

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...