Medium severity6.5NVD Advisory· Published Oct 2, 2025· Updated Jun 17, 2026

CVE-2025-56380

Description

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Erpnext
cpe:2.3:a:frappe:erpnext:15.67.0:*:*:*:*:*:*:*
Frappe/Frappe
cpe:2.3:a:frappe:frappe:15.72.4:*:*:*:*:*:*:*
Frappe/Frappe Frameworkcpe-rescue
Framework.git/framework.gitllm-fuzzy
Range: <=15.72.4

Patches

Vulnerability mechanics

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000