The vulnerability originates from the get_tax_template function in the ERPNext accounting module, which builds an SQL WHERE clause directly from user‑supplied posting_date and args values. Because the input is insufficiently validated, an attacker who is authenticated with low‑privilege rights can inject arbitrary SQL statements and retrieve sensitive database data. The flaw permits data exposure but does not grant arbitrary code execution or system compromise.

Any installation of ERPNext delivered by Frappe that runs a version earlier than 15.109.0 or 16.20.0 is affected. The vulnerability exists within the tax_rule.doctype module of the ERPNext code base and therefore impacts all standard applications built with those releases.

The CVSS score of 6.5 classifies the flaw as moderate. Exploitation requires a valid user account, and the attack path is through the web interface or API that invokes get_tax_template. With no EPSS score published, the probability of exploitation cannot be quantified, but the flaw is not listed in CISA’s KEV catalog, indicating no known public exploits. Nevertheless, an authenticated user can extract data, making patching a prudent action.