← Database

CVE-2025-11461

HIGH CVSS: 8.8 Published: 2025-11-26 Modified: 2026-06-17

Description

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.

Affected Platforms

Frappe Frappe Crm

Weakness Type

CWE-89

References