MajorCritical vulnerability

CVE-2026-111389 (CVSS 8.3)

NVD · officialPublished Oct 16, 2026Risk 37/100EPSS 0.2%

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.

Technical details

CVSS

8.3

AV:NetworkAC:LowPR:LowUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source