HRMS (< 14.38.2, < 15.64.0, < 16.18.0)

Authenticated attackers can exploit a SQL injection vulnerability in specific Frappe HRMS API endpoints to extract sensitive database information due to missing input validation.