CVE-2025-56380: Frappe Erpnext

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter

Affected products

• Frappe Erpnext: version 15.67.0 only
• Frappe Frappe: version 15.72.4 only

Published 2025-10-02. Last modified 2026-06-17.