CVE Feed

    Dashboard / CVE / CVE-2026-111389

    CVE-2026-111389

    Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.

    Published:Oct 16, 2026
    Last Modified:Oct 18, 2026
    EPS:Oct 16, 2026
    EPSS Score:0.00224
    CVSS Score:7.7

    Affected Products

    Vendor
    Frappe
    Product
    Hrms

    Exploits

    https://github.com/Syscallh00k/CVE-2026-111389

    Related CVEs

    CVE-2026-121442 (CVSS 5.3) — Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to v…
    CVE-2026-64862 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA …
    CVE-2026-55796 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salar…
    CVE-2026-108732 (CVSS 5.3) — Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing auth…
    CVE-2026-54524 (CVSS 7.1) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user…
    CVE-2026-45081 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employe…
    CVE-2026-41320 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1,…
    CVE-2026-40889 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, …
    CVE-2026-40888 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High