CVE-2025-66205

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - security-advisories@github.com

Published

2025-12-01

Last modified

2026-10-19

Weaknesses

CWE-89

Affected products

• Frappe (Frappe)

References

• https://github.com/frappe/frappe/security/advisories/GHSA-mp93-8vxr-hqq9
• https://github.com/frappe/frappe/commit/984c641bff9539b6126a01146096f133db6a955b