A specially crafted request to a specific Frappe HR endpoint can allow an attacker to inject SQL code, enabling unauthorized data extraction. The vulnerability is a typical SQL injection flaw (CWE‑89). It does not compromise code execution or affect system integrity beyond data disclosure.

Frappe HRMS versions earlier than 15.54.0 and 14.38.1 are susceptible. The issue applies to the open‑source HR management solution maintained by the Frappe community.

The CVSS score is 6.5, indicating a medium severity risk. No EPSS value is available, so the current exploitation probability is unknown, but the lack of a KEV listing does not preclude potential impact. Attacks would require sending a crafted request, and do not need privileged local access, implying a higher likelihood of exploitation if the endpoint is reachable.