Cve-2026-111389 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-111389/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 04:23:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection Vulnerability in Frappe HRMShttps://feed.craftedsignal.io/briefs/2026-10-frappe-hrms-sql-injection/Fri, 16 Oct 2026 04:23:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-frappe-hrms-sql-injection/Authenticated attackers can exploit a SQL injection vulnerability in specific Frappe HRMS API endpoints to extract sensitive database information due to missing input validation.Frappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contain a critical SQL injection vulnerability originating from inadequate input validation on specific API endpoints. The flaw permits an authenticated user, regardless of their privilege level, to submit maliciously crafted HTTP requests that manipulate backend database queries. If exploited, this allows unauthorized access to data stored within the HRMS database. Given the nature of HRMS platforms, the data at risk typically includes personally identifiable information (PII), payroll details, and other sensitive corporate records. Organizations utilizing affected versions of Frappe HRMS should prioritize patching, as this vulnerability provides a direct pathway for data exfiltration once initial authentication is achieved.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to extract data from the backend database. This impacts any organization running the affected HRMS versions, exposing internal records to potentially any authenticated user within the system. The scale of impact corresponds to the volume and sensitivity of the data housed in the HRMS instance, with potential for significant compliance and privacy ramifications.

Recommendation

  • Upgrade Frappe HRMS to the patched versions immediately: 14.38.2, 15.64.0, 16.18.0 or later.
  • Review web server access logs for anomalous SQL syntax (e.g., 'UNION SELECT', 'OR 1=1', '--') appearing in URI parameters or POST body data originating from authenticated sessions.
  • Enforce the principle of least privilege by restricting user access to API endpoints to only those necessary for their specific roles to limit potential impact if an account is compromised.
]]>highadvisoryweb-application-securitysql-injectioncve-2026-111389