UpHeron
All vulnerabilities

Servers and applications

CVE-2025-55731

Possibility of Authenticated SQL Injection due to improper validations

Severity
Medium 6.3
Published
20 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
14.96.15, 15.74.2
Also known as
GHSA-5p8f-568f-vfq2
Sources
NVD, Project advisories (GitHub)

Description

Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · cpe:a:frappe:frappe
  • Every version before 14.96.15
  • From 15.0.0 before 15.74.2
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 15.74.2
  • Every version before 14.96.15

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-55731
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55731
  • GitHub Advisory Database https://github.com/advisories/GHSA-5p8f-568f-vfq2
  • github.com https://github.com/frappe/frappe/security/advisories/GHSA-5p8f-568f-vfq2