{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111389/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frappe:hrms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-111389"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=334E934A-4C3B-559D-9EF3-CB4A1ABA21E0\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["HRMS (\u003c 14.38.2, \u003c 15.64.0, \u003c 16.18.0)","HRMS (14.x \u003c 14.38.2, 15.x \u003c 15.64.0, 16.x \u003c 16.18.0, develop \u003c= 2026-09-08)"],"_cs_severities":["high"],"_cs_tags":["web-application-security","sql-injection","cve-2026-111389"],"_cs_type":"advisory","_cs_vendors":["Frappe"],"content_html":"\u003cp\u003eFrappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contain a critical SQL injection vulnerability originating from inadequate input validation on specific API endpoints. The flaw permits an authenticated user, regardless of their privilege level, to submit maliciously crafted HTTP requests that manipulate backend database queries. If exploited, this allows unauthorized access to data stored within the HRMS database. Given the nature of HRMS platforms, the data at risk typically includes personally identifiable information (PII), payroll details, and other sensitive corporate records. Organizations utilizing affected versions of Frappe HRMS should prioritize patching, as this vulnerability provides a direct pathway for data exfiltration once initial authentication is achieved.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized actors to extract data from the backend database. This impacts any organization running the affected HRMS versions, exposing internal records to potentially any authenticated user within the system. The scale of impact corresponds to the volume and sensitivity of the data housed in the HRMS instance, with potential for significant compliance and privacy ramifications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Frappe HRMS to the patched versions immediately: 14.38.2, 15.64.0, 16.18.0 or later.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous SQL syntax (e.g., 'UNION SELECT', 'OR 1=1', '--') appearing in URI parameters or POST body data originating from authenticated sessions.\u003c/li\u003e\n\u003cli\u003eEnforce the principle of least privilege by restricting user access to API endpoints to only those necessary for their specific roles to limit potential impact if an account is compromised.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:31:05Z","date_published":"2026-10-16T04:23:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-frappe-hrms-sql-injection/","summary":"Authenticated attackers can exploit a SQL injection vulnerability in specific Frappe HRMS API endpoints to extract sensitive database information due to missing input validation.","title":"SQL Injection Vulnerability in Frappe HRMS","url":"https://feed.craftedsignal.io/briefs/2026-10-frappe-hrms-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111389","version":"https://jsonfeed.org/version/1.1"}