This vulnerability allows an attacker to perform an SQL injection via the get_blog_list endpoint, potentially injecting arbitrary SQL statements into the database. If exploited, the attacker can exfiltrate sensitive data, alter or delete database records, or disrupt application functionality. The weakness stems from improper handling of user input as identified by CWE‑89.

Affected products include the Frappe framework for versions earlier than 15.106.0 and 16.16.0. The issue was addressed in 15.106.0 and 16.16.0, so any deployment running an earlier release is vulnerable.

The CVSS score of 6.9 indicates a medium severity impact. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an unauthenticated or authenticated HTTP GET request to the get_blog_list route, where the application fails to sanitize or parameterize user input.