CVE-2025-52048: SQL Injection
Published Sep 15, 2025
·Updated
In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function addtag() at frappe/desk/doctype/tag/tag.py is vulnerable to SQL Injection, which allows an attacker to extract information from databases by injecting a SQL query into the dt parameter.
Affected Software
3 affected components
Frappe frappe<15.72.0, <14.96.10
Frappe frappe>=14.0.0<14.96.10
Frappe frappe>=15.0.0<15.72.0
Event History
Sep 15, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-52048?
CVE-2025-52048 has a high severity rating due to its potential for SQL Injection attacks.
2
How do I fix CVE-2025-52048?
To fix CVE-2025-52048, upgrade to Frappe version 15.72.0 or 14.96.10 or later.
3
What are the potential impacts of CVE-2025-52048?
The potential impacts of CVE-2025-52048 include unauthorized data access and database information extraction.
4
Who is affected by CVE-2025-52048?
CVE-2025-52048 affects users of Frappe versions prior to 15.72.0 and 14.96.10.
5
What is the nature of the vulnerability in CVE-2025-52048?
CVE-2025-52048 is a SQL Injection vulnerability found in the add_tag() function of Frappe.