CVE-2025-56381: Frappe Erpnext

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.

Affected products

• Frappe Erpnext: version 15.67.0 only
• Frappe Frappe: version 15.72.4 only

Published 2025-10-02. Last modified 2026-06-17.