CVE-2026-111389

EUVD-2026-102570
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 12.26%
Common Weakness Enumeration
References
https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4
https://www.vulncheck.com/advisories/frappe-hrms-14.0.0-before-14.38.2-sql-injection-via-missing-validation