Live › vulnerability › CVE-2026-55796
Go to dashboardThe Salary Payments via ECS report in Frappe HRMS builds its SQL query by directly interpolating report filter values into the query string. An authenticated HR user can craft filter values to read sensitive database records.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Frappe HRMS before 15.60.3 or 16.7.1 where users with the HR role can run the Salary Payments via ECS report. Exposure depends on who holds HR access, since the attacker must be authenticated.
No product ranges from the sources yet.
bench version or by inspecting the hrms app's version file; versions before 15.60.3 and 16.7.1 are affected.15.60.3.16.7.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-55796")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.