Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/frappe/frappe/commit/984c641bff9539b6126a01146096f133db6a955b Patch
- https://github.com/frappe/frappe/security/advisories/GHSA-mp93-8vxr-hqq9 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · frappeNVD modified 2026-10-19 13:10
Affected (CPE criteria) 1
cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*