The vulnerability in Frappe ERPNext is an SQL injection caused by missing input validation in certain endpoints. Authenticated remote attackers can craft requests that alter the formation of database queries, allowing them to retrieve or tamper with sensitive database contents. This flaw enables data exposure or manipulation without additional privileges beyond standard authenticated access, potentially compromising confidential business information.

The issue affects ERPNext applications from the frappe framework that run any version prior to 15.113.0 and any 16.x version older than 16.22.0. Systems using those releases are at risk if they expose the vulnerable endpoints publicly or allow authenticated users to invoke them.

The CVSS score of 7.1 indicates a high risk, though the EPSS score is not available, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not yet listed in the CISA KEV catalog. Attacks require remote authenticated access and the ability to send crafted HTTP requests to the vulnerable endpoints, making it a moderate to high exploitation risk for exposed systems.