UpHeron
All vulnerabilities

Servers and applications

CVE-2025-30214

Information disclosure leading to account takeover

Severity
High 8.0
Published
25 Mar 2025
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
14.89.0, 15.51.0
Also known as
GHSA-qrv3-jc3h-f3m6
Sources
NVD, Project advisories (GitHub)

Description

Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · cpe:a:frappe:frappe
  • Every version before 14.89.0
  • From 15.0.0 before 15.51.0
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 14.89.0
  • Every version before 15.51.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-30214
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-30214
  • GitHub Advisory Database https://github.com/advisories/GHSA-qrv3-jc3h-f3m6
  • github.com https://github.com/frappe/frappe/security/advisories/GHSA-qrv3-jc3h-f3m6