The vulnerability is a SQL injection flaw caused by missing input validation in certain Frappe ERPNext endpoints. Authenticated attackers can craft requests that inject arbitrary SQL into database queries, enabling them to read sensitive data from the underlying database. The primary impact is the potential exposure of confidential business information.

Affected versions include all Frappe ERPNext releases prior to 15.106.0 and any 16.x version before 16.16.0. Users running these versions must verify their current deployment and plan an upgrade.

The CVSS score of 7.1 indicates a medium to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authentication, an attacker must first gain legitimate access before exploiting the injection. Without disclosure, the attacker can read or possibly modify data, but exploitation is limited to those authenticated accounts. The lack of publicly known exploitation code or widespread mention suggests a lower immediate exploitation probability, but the impact if reached is significant.