CVE-2025-11461

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Frappe	Frappe CRM	1.53.1

References

https://fluidattacks.com/advisories/ozExploit, Third Party Advisory
https://github.com/frappe/crmProduct
https://github.com/frappe/crm/pull/1339Issue Tracking, Patch
https://fluidattacks.com/advisories/ozExploit, Third Party Advisory
https://github.com/frappe/crmProduct

Timeline

Published: Nov 26, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-114627.8Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with e CVE-2025-114637.8Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe CVE-2025-114647.8Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attack CVE-2025-114657.8Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu CVE-2025-114664.9Allegra DatabaseBackupBL Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose se CVE-2025-114675.8The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind CVE-2025-114685.7When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This co CVE-2025-114699.8A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the f CVE-2025-11475.3A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitize CVE-2025-114707.2A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown CVE-2025-114719.8A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the file /edit_cus CVE-2025-114729.8A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. This impacts an unknown function of the file /edit_room.php.