UpHeron
All vulnerabilities

Servers and applications

CVE-2025-66205

Possibility of SQL Injection due to improper validations

Severity
Critical 9.8
Published
1 Dec 2025
Last changed
19 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
14.99.2, 15.86.0
Also known as
GHSA-mp93-8vxr-hqq9
Sources
NVD, Project advisories (GitHub)

Description

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · cpe:a:frappe:frappe
  • Every version before 14.99.2
  • From 15.0.0 before 15.86.0
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 15.86.0
  • Every version before 14.99.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-66205
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66205
  • GitHub Advisory Database https://github.com/advisories/GHSA-mp93-8vxr-hqq9
  • github.com https://github.com/frappe/frappe/security/advisories/GHSA-mp93-8vxr-hqq9