CVE-2026-111389
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL…
- Risk score
- 49/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive informati…
- Affected
- See advisory
- Fix
- Upgrade the product to 14.38.2, 15.64.0 or 16.18.0 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
References
Original description
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
Last activity 16 Oct 2026. Patch Forecast updates every hour.