{"id":"CVE-2025-30217","aliases":["GHSA-6phg-4wmq-h5h3","PYSEC-2026-1391"],"title":"Frappe has possibility of SQL injection due to improper validations","summary":"Frappe has possibility of SQL injection due to improper validations","severity":"medium","vendor":"frappe","product":"frappe","ecosystem":"pip","affected":["frappe < 14.93.2","frappe >= 15.0.0, < 15.55.0"],"patched":["frappe 14.93.2","frappe 15.55.0"],"published":"2025-03-26","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6phg-4wmq-h5h3","references":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-6phg-4wmq-h5h3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30217"},{"url":"https://github.com/frappe/frappe"}],"tags":["osv","pip"],"epss":0.00354,"epssPercentile":0.26356,"ingestedAt":"2026-07-08T18:25:46.505Z","slug":"CVE-2025-30217","body":"## Overview\n\n### Impact\nSQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information.\n\n### Workarounds\nUpgrading is required, no other workaround is present.\n\n## Affected packages\n\n- `frappe < 14.93.2`\n- `frappe >= 15.0.0, < 15.55.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `frappe 14.93.2`\n- `frappe 15.55.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}