CVE-2026-55796Medium· 6.5▾ SunlitFrappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.
hrms < 15.60.3hrms >= 16.0.0, < 16.7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111389High· 7.7Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
CVE-2026-54524High· 7.1Frappe HR is an open-source human resources management solution (HRMS)
CVE-2026-64862Medium· 6.5Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
CVE-2026-55823High· 8.7Frappe is a full-stack web application framework
CVE-2026-109674Medium· 6.5Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation
CVE-2026-109663Medium· 6.5Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints