6 results · Clear filters · Feed
-
High 8.8
Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation
Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can…
-
High 8.8
Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint
Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can q…
-
High 8.8
Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action
Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role …
-
High 8.7
Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain r…
-
High 7.7CVE-2026-111389 Public exploit
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafte…
-
High 7.1
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_bas…