Product
Frappe Framework versions prior to 16.33.0 contain a blind SQL injection vulnerability in the get_events method, allowing authenticated attackers to extract sensitive database content.