CVE-2025-66205 HIGH

CVE-2025-66205: Frappe has the possibility of SQL Injection due to improper validations

Vendor Frappe
Product frappe
Weakness CWE-89 · SQLi
Published December 1, 2025
Last update December 1, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

What the vulnerability does

01Description

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.

Key dates

02Disclosure timeline

December 1, 2025 CVE published
December 1, 2025 Record updated