# CVE-2025-11461: Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters…

Source: https://junglewise.ai/threats/cve-2025-11461-multiple-sql-injections-in-frappe-crm-dashboard-controller-due-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-26  
License: CC BY 4.0 with a link back

CVE-2025-11461 · Severity: high · CVSS 8.8 · Published 2025-11-26

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.
This issue affects Frappe CRM: 1.53.1.

Technologies: [Frappe Crm](https://junglewise.ai/threats/technologies/frappe-crm). Vendors: [Frappe](https://junglewise.ai/threats/vendors/frappe).

## Quick answers

**Is CVE-2025-11461 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-11461 being exploited in the wild.

**How severe is CVE-2025-11461?** High severity, with a CVSS score of 8.8, published 26 November 2025.

**Which products and versions are affected?** Frappe Crm. The advisory does not name versions.

**Is there a fix for CVE-2025-11461?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-11461?** Check whether you run Frappe Crm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Frappe Crm

## Related threats

- [Frappe CRM missing authorization in phone lookup API](https://junglewise.ai/threats/cve-2026-116492-frappe-crm-app-before-1-89-1-contains-a-missing-authorization)
- [Frappe CRM missing authorization in call log modification](https://junglewise.ai/threats/cve-2026-111938-frappe-crm-before-1-74-0-contains-a-missing-authorization)
- [Frappe CRM missing authorization in notifications](https://junglewise.ai/threats/cve-2026-111937-frappe-crm-before-1-81-2-contains-a-missing-authorization)
- [Frappe CRM missing authorization in get_linked_docs_of_document](https://junglewise.ai/threats/cve-2026-108734-frappe-crm-1-49-0-through-1-87-0-contains-a-missing)
- [Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could…](https://junglewise.ai/threats/cve-2025-68928-frappe-crm-is-an-open-source-customer-relationship-management)