Frappe ERPNext suffers from a classic SQL injection flaw caused by missing input validation on several endpoints. Remote authenticated users can send crafted requests that alter or bypass the intended SQL statements, enabling them to read or potentially modify sensitive information stored in the database. The weakness is classified as CWE‑89 and can expose confidential data if the attacker controls the query payload.

The flaw affects all installations of Frappe ERPNext running a version prior to 15.98.0 and any 16.x release earlier than 16.6.0. Users running these legacy versions should be aware that any authenticated session can be abused against the vulnerable endpoints. No other product versions are listed as impacted.

The CVSS score of 7.1 indicates a moderate‑to‑high severity risk, while no EPSS data is available and the issue is not listed in the CISA KEV catalog. Exploitation requires valid user credentials, so the attack vector is remote authentication, and the attacker can achieve data exfiltration. Given the lack of automated exploitation data, the overall likelihood of attack remains moderate, but patches should still be applied promptly.