VULNERABILITY INTELLIGENCE

CVE-2025-11461

CVSS score8.8 HIGH
EPSS probability0.37%
CISA KEVNot currently listed
Published2025-11-26
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.

Weakness classification

  • help@fluidattacks.com: CWE-89

Primary references