CVE-2025-30212 json
Frappe has possibility of SQL injection due to improper validations
published 2025-03-25 19 mo ago modified 2026-07-07 4 mo ago also EUVD-2025-8082 , GHSA-3hj6-r5c9-q8f3 , PYSEC-2026-1390
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.
Patch / fix
- pypi frappe 14.89.0, 15.51.0
- frappe frappe 14.89.0, 15.51.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U |
| CNA | 4.0 | 6.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | frappe | <14.89.0 >=15.0.0, <15.51.0 |
14.89.0 15.51.0 |
Affected products
- frappe frappe
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/frappe/frappe/commit/27f13437db161a173137d91cd07d0f9287d7c556
web, patch
-
github.com
/frappe/frappe/commit/2ebd88520ecfa9bb7d3392b7de8c8f94a86ec05c
web, patch
-
github.com
/frappe/frappe/security/advisories/GHSA-3hj6-r5c9-q8f3
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-30212
advisory
-
github.com
/frappe/frappe
package
-
pypi.org
/project/frappe
package
-
github.com
/advisories/GHSA-3hj6-r5c9-q8f3
advisory
Sources
- CVE List CVE-2025-30212
- GitHub Advisory GHSA-3hj6-r5c9-q8f3
- NVD CVE-2025-30212
- OSV PYSEC-2026-1390
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.