Frappe has possibility of SQL injection due to improper validations

高 7.5CVE-2025-30212 · GHSA-3hj6-r5c9-q8f3 · PYSEC-2026-1390 · 25/03/2025 公開 · 17/06/2026 更新

要点

CVE-2025-30212 は frappe, frappe (frappe) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.44%（全脆弱性の 38.5% より高い）。
対処：15.51.0, 14.89.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
frappe PyPI	`≥ 15.0.0, < 15.51.0< 14.89.0`	`15.51.014.89.0`
frappe frappe	`≥ 15.0.0, < 15.51.0< 14.89.0`	`15.51.014.89.0`

概要

Impact

An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information.

Workarounds

Upgrading is required, no other workaround is present.

Credits

Thanks to Thanh of Calif.io for reporting the issue

NVD の説明

Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.