Frappe CVE-2025-10655

This vulnerability presents significant real-world risk based on multiple converging signals. The CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impact (VC:H/VI:H) with network attack vector and low complexity, indicating straightforward exploitation. Publicly available exploit code exists (confirmed by Fluid Attacks advisory and GitHub PR references), substantially lowering the barrier to exploitation. However, the requirement for low privileges (PR:L) means attackers need authenticated access, reducing the attack surface compared to unauthenticated vulnerabilities. No CISA KEV listing indicates no confirmed active exploitation in the wild at time of analysis. The vulnerability is automatable once credentials are obtained, and the technical impact is severe (database compromise). SSVC decision factors suggest elevated priority: exploitation is public (POC available), automatable (SQL injection tools exist), and technical impact is total (confidentiality and integrity). Organizations using Frappe HelpDesk 1.14.0 should prioritize remediation, especially if the application is internet-facing or accessible to untrusted authenticated users.

An authenticated attacker with low-privilege access to Frappe HelpDesk 1.14.0 crafts malicious requests to the dashboard's get_dashboard_data endpoint, injecting SQL commands through vulnerable parameters. By manipulating these inputs, the attacker executes arbitrary SQL queries to extract sensitive customer support data, user credentials, or modify database records. Given the publicly available exploit code from Fluid Attacks, an attacker with basic SQL injection knowledge can rapidly weaponize this vulnerability to compromise the entire HelpDesk database.