CVE-2025-30212

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-30212
Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/frappe/frappe/commit/27f13437db161a173137d91cd07d0f9287d7c556 Patch
https://github.com/frappe/frappe/commit/2ebd88520ecfa9bb7d3392b7de8c8f94a86ec05c Patch
https://github.com/frappe/frappe/security/advisories/GHSA-3hj6-r5c9-q8f3 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*
cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*
History

01 Aug 2025, 15:52

Type Values Removed Values Added
First Time Frappe
Frappe frappe
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*
References () https://github.com/frappe/frappe/commit/27f13437db161a173137d91cd07d0f9287d7c556 - () https://github.com/frappe/frappe/commit/27f13437db161a173137d91cd07d0f9287d7c556 - Patch
References () https://github.com/frappe/frappe/commit/2ebd88520ecfa9bb7d3392b7de8c8f94a86ec05c - () https://github.com/frappe/frappe/commit/2ebd88520ecfa9bb7d3392b7de8c8f94a86ec05c - Patch
References () https://github.com/frappe/frappe/security/advisories/GHSA-3hj6-r5c9-q8f3 - () https://github.com/frappe/frappe/security/advisories/GHSA-3hj6-r5c9-q8f3 - Vendor Advisory

27 Mar 2025, 16:45

Type Values Removed Values Added
Summary
  • (es) Frappe es un framework de aplicaciones web integral. Se ha identificado una vulnerabilidad de inyección SQL en Frappe Framework anterior a las versiones 14.89.0 y 15.51.0, que podría permitir que un atacante acceda a información confidencial. Las versiones 14.89.0 y 15.51.0 solucionan el problema. Se requiere una actualización; no hay otro workaround.

25 Mar 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-25 15:15

Updated : 2025-08-01 15:52

NVD link : CVE-2025-30212

Mitre link : CVE-2025-30212

CVE.ORG link : CVE-2025-30212

JSON object : View

Products Affected

frappe

  • frappe
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')