CVE-2025-56380

6.5

MEDIUMCVSS v3

Published

October 2, 2025

Affected

7 projects

Assigned by

MITRE

Severity scale

010

Description

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter

frappe/frappe

GitHubLow code web framework for real world applications, in Python and Javascript

= 15.72.4NVD

frappe/erpnext

GitHubFree and Open Source Enterprise Resource Planning (ERP)

= 15.67.0NVD

Frappe

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

The core implementation library for Frappe. Frappe is a compile time bundler for JavaScript, Css, and Less for high volume, high performance ASP.NET sites.

= 15.72.4NVD