The Frappe Framework suffers a blind SQL injection flaw in the get_events method of the frappe.desk.doctype.event.event class. The method fails to escape or parameterize user‑supplied input before embedding it into SQL statements. Authenticated attackers can send specially crafted requests to this endpoint and, by observing timing or other side‑channel cues, infer the contents of database records. This allows the extraction of sensitive data, potentially compromising confidentiality and integrity of business information stored in the backend.

The vulnerability affects the Frappe Framework prior to version 16.33.0. Stakeholders running any older release of the framework, especially in production environments that expose the events API, are at risk. Administrators should verify the installed release and apply the appropriate update if necessary.

The CVSS score of 7.1 indicates a moderate to high impact, whereas the absence of an EPSS score and lack of inclusion in the CISA KEV list suggest that widespread exploitation is not yet documented. Attackers would need authenticated access to the system and the ability to invoke the get_events API; the vulnerability is not exploitable by unauthenticated network users. Nonetheless, an attacker who can authenticate could easily extract sensitive data, making remediation a high priority even if the likely exploitation window is limited.