GHSA-3hj6-r5c9-q8f3Medium

Frappe has possibility of SQL injection due to improper validations

Published
March 25, 2025
Last Modified
March 30, 2025

🔗 CVE IDs covered (1)

CVE-2025-30212 →

📋 Description

Impact

An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information.

Workarounds

Upgrading is required, no other workaround is present.

Credits

Thanks to Thanh of Calif.io for reporting the issue

🎯 Affected products2

  • pip/frappe:< 14.89.0
  • pip/frappe:>= 15.0.0, < 15.51.0

🔗 References (5)