Hrms (Frappe) - vulnerabilities (CVEs)

8 CVEs, 3 in the last 30 days, 2 known versions, newest CVE from 2026-10-16. Vendor: Frappe.

CVEs of Hrms

• CVE-2026-64862 - CVSS 6.5 (medium), 2026-10-16: Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not…
• CVE-2026-55796 - CVSS 6.5 (medium), 2026-10-16: Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report…
• CVE-2026-111389 - CVSS 8.3 (high), 2026-10-16: Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input…
• CVE-2026-54524 - CVSS 7.1 (high), 2026-09-17: Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through…
• CVE-2026-45081 - CVSS 6.5 (medium), 2026-05-27: Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details…
• CVE-2026-41320 - CVSS 6.5 (medium), 2026-04-21: Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain…
• CVE-2026-40889 - CVSS 6.5 (medium), 2026-04-21: Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized…
• CVE-2026-40888 - CVSS 6.5 (medium), 2026-04-21: Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can…