Skip to content
Threat Feed
Subscribe

Product

HRMS (14.x < 14.38.2, 15.x < 15.64.0, 16.x < 16.18.0, Develop <= 2026-09-08)

1 brief RSS
high advisory

SQL Injection Vulnerability in Frappe HRMS

Authenticated attackers can exploit a SQL injection vulnerability in specific Frappe HRMS API endpoints to extract sensitive database information due to missing input validation.

PoC HRMS +1 web-application-security sql-injection cve-2026-111389
1t 1c