MEDIUM Published October 2, 2025

CVE-2025-56380

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter

CVSS base score

6.5 (v3.1)

Severity

MEDIUM

Attack vector

Network

Weakness

CWE-89

Last modified

November 5, 2026

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

frappe erpnext frappe frappe

References

github.com Not Applicable
github.com Exploit, Third Party Advisory

View full NVD advisory →

More frappe vulnerabilities

Published the same day

← Back to CVE watch

CVE-2025-56380

Affected products

References

More frappe vulnerabilities

Published the same day

Related reading