Frappe is vulnerable to a SQL injection through its bulk_update functionality, allowing attackers to inject and execute arbitrary SQL commands against the underlying database. This flaw can enable unauthorized reading of sensitive data or alteration of critical application tables, compromising confidentiality and integrity. The weakness is a classic unchecked input leading to SQL injection, identified as CWE‑89.

The vulnerability affects the Frappe web application framework for all users running versions older than 16.14.0 or 15.104.0. Versions 16.14.0 and 15.104.0 and later contain the fix and are therefore safe, provided no other backdoors exist.

The base score of 9.3 indicates a very high severity. The EPSS value is below 1%, suggesting that the probability of real‑world exploitation is low but still possible, especially if an attacker gains the necessary privilege to invoke bulk_update. The vulnerability is not listed in CISA’s catalog of known exploited vulnerabilities, further reducing the likelihood of immediate exploitation. However, the impact of successful exploitation would be catastrophic, granting full control over the database.