CVE-2025-58375

Katalog CVE

CVSS 8.1 · High EPSS 0,34%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.

Rincian

Terbit di NVD

6 September 2025

Terakhir diubah

8 September 2026

Status NVD

Deferred

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/frappe/frappe/commit/2dab009c8b15e29aa14bcd421eee8c6b2dc0fce6
• https://github.com/frappe/frappe/commit/ec70383ef0196d7b64fcf51b230483dac095a68b
• https://github.com/frappe/frappe/security/advisories/GHSA-mggw-6xqj-rphj