medium5.3
CVE-2025-71431
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters befor…
Impact
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
Affected products
| Product | Affected versions |
|---|---|
| Frappe | before 14.99.2 |
| 15.X | before 15.86.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.