high7.7
CVE-2026-111389
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input …
Impact
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
Affected products
| Product | Affected versions |
|---|---|
| Frappe HRMS 14.X | before 14.38.2 |
| 15.X | before 15.64.0 |
| And 16.X | before 16.18.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.