high7.1
CVE-2025-66205
Frappe is a full-stack web application framework.
Impact
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Frappe | Frappe | before 14.99.2 from 15.0.0 before 15.86.0 |