High severity7.5NVD Advisory· Published Mar 26, 2025· Updated Jun 17, 2026

CVE-2025-30217

Description

Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 contain a patch for the issue. No known workarounds are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
frappePyPI	< 14.93.2	14.93.2
frappePyPI	>= 15.0.0, < 15.55.0	15.55.0

Affected products

Frappe/Frappe2 versions
cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*range: <14.93.2
- (no CPE)range: < 14.93.2
ghsa-coords
pkg:pypi/frappe
Range: < 14.93.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-6phg-4wmq-h5h3ghsaADVISORY
github.com/frappe/frappe/security/advisories/GHSA-6phg-4wmq-h5h3nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2025-30217ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000