The vulnerability is an SQL injection in the Inactive Customers report of ERPNext, caused by an unvalidated `doctype` filter that is directly interpolated into raw SQL in the `get_sales_details` and `get_last_sales_amt` functions. An attacker who can authenticate to the system can supply a crafted filter value, enabling extraction of arbitrary database records or modification of data, thereby compromising confidentiality, integrity, and potentially availability of the application.

Frappe ERPNext versions earlier than 15.116.0 and earlier than 16.23.0 are affected. The issue was resolved in the 15.116.0 release and again in the 16.23.0 release; any later releases do not inherit the flaw.

The CVSS score is 7.6, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no public exploit is known. Because the exploit requires an authenticated user session, the attack vector is likely through the web interface after login. An attacker with legitimate credentials or who has compromised an account can trigger the report, feed a malicious doctype value, and execute arbitrary SQL, exposing sensitive data or altering records.