UpHeron
All vulnerabilities

Servers and applications

CVE-2025-52895

Possibility of SQL injection due to improper validations

Severity
High 8.7
Published
30 Jun 2025
Last changed
19 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
14.94.3, 15.58.0
Also known as
GHSA-mhj8-jfhf-mcw9
Sources
NVD, Project advisories (GitHub)

Description

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for this issue other than upgrading.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · cpe:a:frappe:frappe
  • Every version before 14.94.3
  • From 15.0.0 before 15.58.0
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 15.58.0
  • Every version before 14.94.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-52895
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-52895
  • GitHub Advisory Database https://github.com/advisories/GHSA-mhj8-jfhf-mcw9
  • github.com https://github.com/frappe/frappe/security/advisories/GHSA-mhj8-jfhf-mcw9