Live › vulnerability › CVE-2026-111389
Go to dashboardFrappe HRMS versions before 14.38.2, 15.64.0 and 16.18.0 have SQL injection in some endpoints because input is not validated. Any logged-in user, including low-privilege accounts, can send crafted requests to extract sensitive data from the database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Frappe HRMS self-hosted on one of the affected version lines are exposed. Any account that can log in, including low-privilege employee accounts, can reach the vulnerable endpoints. Instances already on the fixed versions, or not running HRMS, can skip it.
No product ranges from the sources yet.
bench version or the hrms entry in the apps list, and compare it to the fixed releases.14.38.2 on the 14.x line, 15.64.0 on the 15.x line, or 16.18.0 on the 16.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
This page as .md · .json · in your agent: get_signal("CVE-2026-111389")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.