Frappe HR’s Salary Payments via ECS report builds SQL conditions by inserting user‑supplied filter values directly into an SQL string. An authenticated HR user can manipulate these filters to inject arbitrary SQL code, allowing read access to sensitive database tables. The flaw is a classic SQL injection vulnerability (CWE‑89) that exposes personnel records and other confidential data but does not provide code execution or privilege escalation beyond data disclosure.

Versions of Frappe HRMS before 15.60.3 and 16.7.1 are affected. The Salary Payments via ECS report in those releases is a valid entry point for attackers who possess HR credentials.

The CVSS score is 6.5, indicating moderate severity. EPSS data is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated HR role and the ability to submit report filter input, limiting the potential attackers to users already authorized to use the Salary Payments via ECS report.