CVE-2026-111389High· 7.7▾ MidnightPoC availableFrappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
1 GitHub repo
Last analysed / modified upstream
0.2% → 0.3%
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
hrms >= 14.0.0 < 14.38.2hrms >= 15.0.0 < 15.64.0hrms >= 16.0.0 < 16.18.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55796Medium· 6.5Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
CVE-2026-54524High· 7.1Frappe HR is an open-source human resources management solution (HRMS)
CVE-2026-108732Medium· 4.3Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts
CVE-2026-114664High· 7.1Frappe before 16.33.0 Blind SQL Injection via get_events
CVE-2026-64862Medium· 6.5Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
CVE-2026-55823High· 8.7Frappe is a full-stack web application framework