CVE-2025-10655High· 8.8▾ TwilightSQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.
helpdesk = 1.14.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114664High· 7.1Frappe before 16.33.0 Blind SQL Injection via get_events
CVE-2026-111939Medium· 4.6Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
CVE-2026-55796Medium· 6.5Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
CVE-2026-111389High· 7.7Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
CVE-2026-55823High· 8.7Frappe is a full-stack web application framework
CVE-2026-109674Medium· 6.5Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation