ERPNext, a widely used open-source ERP platform, suffers from a SQL injection flaw due to missing validation in several endpoints prior to version 16.9.0. The flaw allows an attacker to craft malicious requests that bypass input checks, resulting in arbitrary SQL statements being executed against the underlying database. This can expose sensitive organizational data, including customer details, financial records, and internal configurations.

Systems impacted are installations of ERPNext from any vendor using the frappe:erpnext product line with a release older than 16.9.0. No specific patch version list is given, but the advisory states that applying upgrade to 16.9.0 or later removes the vulnerability. The affected components are the web endpoints that construct SQL queries without parameterization.

The CVSS base score of 8.8 indicates a high severity vulnerability, and the lack of an EPSS score means the exploitation probability is not quantified at this time. Since the attack vector is likely through HTTP interfaces accepting user input, remote actors can exploit the flaw if they can reach the vulnerable endpoints. The vulnerability is not listed in CISA's KEV catalog, but given its potential for data exfiltration, organizations should treat it as high risk until patched.