CVE-2026-111389: Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 are affected. Versions at or above those respective releases are not identified as affected by this issue.
Does exploitation require an existing account or user interaction?
An attacker must be authenticated, but a low-privilege account is sufficient. No user interaction is required, and the attack can be performed over the network using specially crafted requests to affected endpoints.
What is the likely impact if the vulnerability is exploited?
The stated impact is extraction of sensitive information from the database through SQL injection. The provided information does not identify data modification or service-disruption impact.