CVE-2025-10655
Frappe Helpdesk 1.14.0
- Class
- SQLi
- Severity
- High · CVSS 4.0 score 8.6
- Disclosed
- Credit
- Cristian Vargas, Fluid Attacks Offensive Team
- Code name
- dyango
- Affected
- Frappe Helpdesk 1.14.0
The defect
SQL injection (get_dashboard_data filters.team)
Class overview · SQLi
User-controlled text reaches a SQL query without being separated from the query structure. The attacker can read or change data beyond the intended filter; the exact set depends on the query and the database permissions behind it.