CVE-2025-56381

6.5

MEDIUMCVSS v3

Published

October 2, 2025

Affected

7 projects

Assigned by

MITRE

Severity scale

010

Description

ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.

frappe/frappe

GitHubLow code web framework for real world applications, in Python and Javascript

= 15.72.4NVD

frappe/erpnext

GitHubFree and Open Source Enterprise Resource Planning (ERP)

= 15.67.0NVD

Frappe

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

The core implementation library for Frappe. Frappe is a compile time bundler for JavaScript, Css, and Less for high volume, high performance ASP.NET sites.

= 15.72.4NVD