# CVE-2025-66205: Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to…

Source: https://junglewise.ai/threats/cve-2025-66205-frappe-is-a-full-stack-web-application-framework-prior-to-15-86-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01  
License: CC BY 4.0 with a link back

CVE-2025-66205 · Severity: high · CVSS 7.1 · Published 2025-12-01

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.

Technologies: [Frappe](https://junglewise.ai/threats/technologies/frappe). Vendors: [Frappe](https://junglewise.ai/threats/vendors/frappe).

## Quick answers

**Is CVE-2025-66205 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66205 being exploited in the wild.

**How severe is CVE-2025-66205?** High severity, with a CVSS score of 7.1, published 1 December 2025.

**Which products and versions are affected?** Frappe. The advisory does not name versions.

**Is there a fix for CVE-2025-66205?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66205?** Check whether you run Frappe. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Frappe

## Related threats

- [Frappe path traversal in file upload](https://junglewise.ai/threats/cve-2026-119145-frappe-before-15-121-0-and-16-x-before-16-34-0-contains-a-path)
- [Frappe open redirect in OAuth login flow](https://junglewise.ai/threats/cve-2026-66057-frappe-is-a-full-stack-web-application-framework-prior-to-15-116)
- [Frappe SQL injection in reportview get_count method](https://junglewise.ai/threats/cve-2026-55823-frappe-is-a-full-stack-web-application-framework-prior-to-16-23-0)
- [Frappe missing authorization in record modification](https://junglewise.ai/threats/cve-2026-109599-frappe-before-15-113-3-and-16-x-before-16-25-0-contains-a)
- [Frappe LDAP injection in endpoint parameters](https://junglewise.ai/threats/cve-2025-71431-frappe-before-14-99-2-and-15-x-before-15-86-0-contains-an-ldap)