CVE-2025-56380: SQL Injection
Published Oct 2, 2025
·Updated
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter
Affected Software
3 affected components
Frappe Frappe Framework
Frappe ERPNext=15.67.0
Frappe frappe=15.72.4
Event History
Oct 1, 2025
Exploit Published
via GitHub·07:14 PM
Oct 2, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-56380?
CVE-2025-56380 is classified as a high-severity SQL injection vulnerability.
2
How do I fix CVE-2025-56380?
To fix CVE-2025-56380, update Frappe Framework to the latest version that addresses this vulnerability.
3
What is the impact of CVE-2025-56380?
The impact of CVE-2025-56380 can lead to unauthorized data access and manipulation through crafted database queries.
4
What affected versions are there for CVE-2025-56380?
CVE-2025-56380 affects Frappe Framework version 15.72.4 and possibly earlier versions.
5
How does CVE-2025-56380 exploit SQL injection?
CVE-2025-56380 exploits SQL injection via the fieldname parameter in the frappe.client.get_value API endpoint.