CVE-2025-55731

6.3 mediumEPSS 0.4%

Medium (6.3) in frappe frappe. EPSS 0.4% chance of exploitation in the next 30 days.

Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.

Severity

CVSS 4.0

6.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2025-08-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

frappe:frappe

References

https://github.com/frappe/frappe/commit/93ee30c638bf7a7e33e2937a0adccac14c38b410
https://github.com/frappe/frappe/commit/c2b01e3eb6f50e9bd05df0440f5cbf5dfbc1badd
https://github.com/frappe/frappe/security/advisories/GHSA-5p8f-568f-vfq2

Check your stack JSON