Frappe Hrms
10 CVEs affecting Frappe Hrms. Latest disclosed: 2026-10-16. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-111389 | High | 7.7 | 2026-10-16 | Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input… |
CVE-2026-64862 | Medium | 6.5 | 2026-10-16 | Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistent… |
CVE-2026-55796 | Medium | 6.5 | 2026-10-16 | Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report condi… |
CVE-2026-45081 | Medium | 6.5 | 2026-05-27 | Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details du… |
CVE-2026-41320 | Medium | 6.5 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain en… |
CVE-2026-40889 | Medium | 6.5 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files… |
CVE-2026-40888 | Medium | 6.5 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can acces… |
CVE-2026-108733 | Medium | 4.3 | 2026-10-11 | Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire… |
CVE-2026-108732 | Medium | 4.3 | 2026-10-11 | Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_ac… |
CVE-2026-54524 | | 2026-09-17 | Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through fil… |