The vulnerability is caused by improper input sanitization on a specific endpoint within the Frappe framework, allowing an attacker to inject malicious SQL code. This flaw is classified as CWE‑89. When exploited, the attacker can read database records that the application should not expose, compromising the confidentiality of sensitive data.

The affected software is the Frappe web application framework (vendor: frappe, product: frappe). Versions older than 15.84.0 for the current release line and older than 14.99.0 for the prior line are susceptible.

Risk is high, with a CVSS score of 9.3 and an EPSS score below 1 %. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly confirmed exploits at this time. The likely attack vector is a remote, unauthenticated request to the vulnerable endpoint, as inferred from the advisory description. Exploitation requires only network access and does not need privileged credentials.