This vulnerability is a classic SQL injection flaw caused by missing input validation in certain endpoints. An attacker who is authenticated can construct specially crafted that bypass the validation and inject arbitrary SQL statements. The result is the ability to query or manipulate the database, potentially exposing sensitive business data. The weakness is enumerated as CWE-89. The impact is primarily a breach of confidentiality with the possibility of broader data manipulation if the injected commands alter database state, though no denial of service or code execution is described in the advisory.

The affected product is Frappe ERPNext. Versions before 15.110.0 and all 16.x releases before 16.21.0 contain the flaw. Users should verify which version of ERPNext they are running and plan an upgrade accordingly.

The CVSS score of 7.1 places the flaw in the high severity band, indicating a significant risk if exploited. EPSS information is not available, so we cannot quantify current exploitation likelihood, but the vulnerability is not listed in the CISA KEV catalog. The attack requires authentication, implying that users with valid credentials could exploit it. Without patches, the danger is that an insider or compromised user could extract confidential information from the database.