CVE-2025-52898— Frappe account takeover via password reset token leakage
Quick assessment
Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe Technologies Frappe是印度Frappe Technologies公司的一个基于Python、Mariadb的并集成前端页面的Web开发框架。 Frappe Technologies Frappe 14.94.3之前版本和15.58.0之前版本存在信息泄露漏洞，该漏洞源于特制请求可能导致密码重置令牌泄露。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-52898
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe account takeover via password reset token leakage
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue has been patched in versions 14.94.3 and 15.58.0. Workarounds for this issue involve verifying password reset URLs before clicking on them or upgrading for self hosted users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Frappe Technologies Frappe 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Frappe Technologies Frappe是印度Frappe Technologies公司的一个基于Python、Mariadb的并集成前端页面的Web开发框架。 Frappe Technologies Frappe 14.94.3之前版本和15.58.0之前版本存在信息泄露漏洞，该漏洞源于特制请求可能导致密码重置令牌泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-52898
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-52898
请登录查看更多情报信息。
Same Patch Batch · frappe · 2025-06-30 · 3 CVEs total
| CVE-2025-52896 | Frappe authenticated XSS via data import | |
| CVE-2025-52895 | Frappe possibility of SQL injection due to improper validations |
IV. Related Vulnerabilities
Same product: frappe
-
CVE-2026-66002
Frappe: User Enumeration via PDDR -
CVE-2026-66001
Frappe: Improper Authorization in OAuth2 Consent Endpoint -
CVE-2026-62315
Frappe: Mass assignment via set_value -
CVE-2026-63654
Frappe: Unauthenticated Workflow approval via confirm_action -
CVE-2026-53569
Frappe: Missing authorization in toggle_like and mark_as_see
Same vendor: frappe
-
CVE-2026-66002
Frappe: User Enumeration via PDDR -
CVE-2026-66001
Frappe: Improper Authorization in OAuth2 Consent Endpoint -
CVE-2026-62315
Frappe: Mass assignment via set_value -
CVE-2026-63654
Frappe: Unauthenticated Workflow approval via confirm_action -
CVE-2026-53569
Frappe: Missing authorization in toggle_like and mark_as_see
Same weakness: CWE-200
-
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery -
CVE-2026-56380
AVideo feed/index.php Exposure of Channel Owner Email Addres -
CVE-2026-48050
Arc: Unauthenticated access to Go debug pprof endpoints leak -
CVE-2026-34948
Combodo iTop: Access control bypass via OQL joins -
CVE-2026-53497
CrossWatch: Unauthenticated /api/app-auth/status endpoint le
V. Comments for CVE-2025-52898
No comments yet