CVE-2025-56380

Name of the Vulnerable Software and Affected Versions Frappe Framework version 15.72.4

Description A SQL injection issue exists in Frappe Framework. The issue is located in the fieldname parameter of the frappe.client.get value API endpoint. A crafted script provided to the fieldname parameter can exploit this issue.

Recommendations Apply a fix for Frappe Framework version 15.72.4 to address the SQL injection vulnerability in the frappe.client.get value API endpoint. As a temporary workaround, restrict access to the frappe.client.get value API endpoint or sanitize the fieldname parameter to prevent SQL injection attacks.