Frappe ERPNext before version 15.106.0 and 16.x before 16.16.0 contains an SQL injection flaw in multiple endpoints due to missing input validation. Authenticated attackers can craft requests that alter SQL queries, enabling extraction of sensitive data from the ERPNext database. The weakness aligns with CWE‑89 and presents a direct route to compromising confidential information.

Vendors affected include Frappe ERPNext. Releases in the 15.x branch prior to version 15.106.0 and the 16.x branch prior to version 16.16.0 are vulnerable. Any deployment of these unpatched versions is at risk.

The CVSS score of 7.1 signals high severity. EPSS is not available, and the issue is not yet catalogued in CISA KEV. Exploitation requires authenticated access to ERPNext, which many organizations grant to internal users. With valid credentials or a compromised account, an attacker can exploit the endpoint, and because the flaw allows arbitrary SQL commands, the likelihood of real‑world exploitation is substantial. The attack vector is inferred to be via HTTP endpoints exposed by ERPNext, which fail to enforce input validation before building queries.