CVE Feed

    Dashboard / CVE / CVE-2026-54524

    CVE-2026-54524

    Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.

    Published:Sep 17, 2026
    Last Modified:Sep 18, 2026
    EPS:Sep 17, 2026
    EPSS Score:0.00278
    CVSS Score:7.1

    Affected Products

    Vendor
    Frappe
    Product
    Hrms

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-121442 (CVSS 5.3) — Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to v…
    CVE-2026-64862 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA …
    CVE-2026-55796 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salar…
    CVE-2026-111389 (CVSS 8.3) — Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnera…
    CVE-2026-108732 (CVSS 5.3) — Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing auth…
    CVE-2026-45081 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employe…
    CVE-2026-41320 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1,…
    CVE-2026-40889 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, …
    CVE-2026-40888 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High