CVE-2025-11461

High · 8.8

CVSS

8.8

EPSS

0.3%

Published

Nov 26, 2025

CISA due date

—

The record

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.

Affected packages

Ecosystem	Package	Introduced	Fixed