CVE-2025-52895

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-52895
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52895.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-52895
Aliases
  • GHSA-mhj8-jfhf-mcw9
Published
2025-06-30T17:05:36.027Z
Modified
2026-04-10T05:30:45.512604Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Frappe possibility of SQL injection due to improper validations
Details

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for this issue other than upgrading.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52895.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/frappe/frappe

Affected ranges

Type
GIT
Repo
https://github.com/frappe/frappe
Events
Introduced
b8c1f492c492f7cbbfd3cc768234fbb244fd3737
Fixed
5cef18d25568a3c4bbac83115b12999eb12cae5d

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52895.json"