CVE-2026-111389
7.7HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-89
Impact
Authenticated low-privilege users can extract sensitive database records via SQL injection over the network. They only need valid login credentials to affected endpoints.
Root cause
Endpoints fail to validate user input before passing it into database queries.
Affected systems
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade Frappe HRMS to 14.38.2, 15.64.0, 16.18.0, or newer; no interim workaround is documented.
$ bench update --apps hrmsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.