Medium severity5.3NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2025-71431

Description

Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Frappellm-fuzzy
Range: <14.99.2, <15.86.0

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/security/advisories/GHSA-qrq5-v93p-8xhwnvd
www.vulncheck.com/advisories/frappe-before-15.86.0-ldap-injection-via-unsanitized-endpoint-parametersnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000