CVE-2025-55731

Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.

More information : https://github.com/frappe/frappe/commit/93ee30c638bf7a7e33e2937a0adccac14c38b410