PT-2025-48549 · Frappé Technologies · Frappe

Published 2025-12-01 · Updated 2025-12-26 · CVE-2025-66205

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.86.0 Frappe versions prior to 14.99.2

Description Frappe, a full-stack web application framework, contains a flaw due to insufficient validation of parameters. This allows for error-based SQL injection through a specific endpoint, potentially enabling the retrieval of information such as the version.

Recommendations Update to Frappe version 15.86.0 or later. Update to Frappe version 14.99.2 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-66205

GHSA-MP93-8VXR-HQQ9

Affected Products

Frappe

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66205.json · Exploit
• https://github.com/frappe/frappe/security/advisories/GHSA-mp93-8vxr-hqq9 · Vendor Advisory
• https://github.com/frappe/frappe/commit/984c641bff9539b6126a01146096f133db6a955b · Patch
• https://osv.dev/vulnerability/CVE-2025-66205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66205 · Security Note
• https://twitter.com/SecReportCVE/status/2004604489542598938 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1995722263102910682 · Twitter Post
• https://t.me/CVEtracker/38584 · Telegram Post
• https://twitter.com/CVEnew/status/1995596446804931037 · Twitter Post