An HTML injection vulnerability exists in Fairsketch's RISE CRM Framework version 3.8.1. The flaw arises from insufficient validation of user input in the 'custom_field_1' parameter of the '/estimate_requests/save_estimate_request' endpoint, allowing injection of arbitrary HTML code.