CVE-2026-111389

HighCVSS 7.7

Published: 16/10/2026(UTC)Updated: 18/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Frappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints due to missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to extract sensitive information from the database.

Risk Assessment

An attacker can access sensitive data stored in the database, potentially leading to confidentiality breaches and further attacks.

Recommendation

Update Frappe HRMS to version 14.38.2, 15.64.0, or 16.18.0 (or later) to fix the vulnerability.

Other vulnerabilities in Frappe HRMS

CVE-2026-121442Medium
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.

Original NVD description (English source)

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS