TI-2025-40709 Aliases CVE-2025-66205

Frappe has the possibility of SQL Injection due to improper validations

MEDIUM 43CWE-89Published 2025-12-01 · Updated 2025-12-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00333 26th percentileScored 2026-11-07

Fix Fixed frappe (frappe): 15.86.0, 14.99.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
frappe	frappe	15.0.0 to before 15.86.0; before 14.99.2	15.86.0, 14.99.2	Patch available	CNA

frappe Vendorfrappe Affected 15.0.0 to before 15.86.0; before 14.99.2 Fixed in 15.86.0, 14.99.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:frappe:frappe::::::::	before 14.99.2; 15.0.0 to before 15.86.0	Vulnerable	frappe

cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:* Versions before 14.99.2; 15.0.0 to before 15.86.0 Vulnerable ·frappe

Remediation

Fix · CNA frappe (frappe) Fixed in 15.86.0, 14.99.2

Timeline

2026-10-02 Threatist record created from CVE-2025-66205

References

Patch 1

https://github.com/frappe/frappe/commit/984c641bff9539b6126a01146096f133db6a955b

Advisory 1

https://github.com/frappe/frappe/security/advisories/GHSA-mp93-8vxr-hqq9

TI-2025-35319 ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the… CVSS 3.1MEDIUM 6.5
TI-2025-35318 Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the… CVSS 3.1MEDIUM 6.5
TI-2022-20104 Path traversal in Frappe CVSS 3.1MEDIUM 6.5
TI-2025-35317 A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT… CVSS 3.1MEDIUM 5.4
TI-2026-03168 Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer CVSS 4.0MEDIUM 4.6
TI-2023-24769 Frappe vulnerable to HTML injection by any Desk user CVSS 3.1MEDIUM 5.4

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences