The vulnerability is a missing input validation that allows a SQL injection flaw in several HRMS endpoints. Any authenticated user, even with low‑privilege rights, can construct crafted requests that the database processes as legitimate SQL commands, leading to the extraction of sensitive data. The primary consequence is the unauthorized compromise of confidential database contents, potentially exposing personal, financial, or proprietary information.

The affected product is Frappe HRMS. Versions 14.x prior to 14.38.2, 15.x prior to 15.64.0, and 16.x prior to 16.18.0 are vulnerable. Users deploying these releases should verify their installed version against these ranges.

The CVSS score of 8.3 indicates a high severity if exploited, while the EPSS score of <1% suggests a very low likelihood of exploitation in the near term. Nonetheless, the flaw requires authentication, even from low‑privilege accounts, enabling an attacker who has accessed the system to extract confidential data. Successful exploitation could also provide a foothold for further attacks.