CVE-2025-66437 — An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.render_template( — CVE Database · The Intelligence Room