CVE-2025-11461
Frappe CRM 1.53.1 (fixed 1.54.0)
- Class
- SQLi
- Severity
- High · CVSS 4.0 score 7.1
- Disclosed
- Credit
- Cristian Vargas, Fluid Attacks Offensive Team
- Code name
- oz
- Affected
- Frappe CRM 1.53.1 (fixed 1.54.0)
The defect
SQL injection (multiple, dashboard controller)
Class overview · SQLi
User-controlled text reaches a SQL query without being separated from the query structure. The attacker can read or change data beyond the intended filter; the exact set depends on the query and the database permissions behind it.