CVE-2025-11461: Frappe CRM

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.

Affected products

• Frappe Frappe CRM: version 1.53.1 only

Published 2025-11-26. Last modified 2026-06-17.