Frappe Hr vulnerabilities

• frappe hrms Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API CVE-2026-121442 5.3 MediumNovember 3, 2026
• frappe hrms Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS CVE-2026-64862 6.5 MediumOctober 16, 2026
• frappe hrms Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report CVE-2026-55796 6.5 MediumOctober 16, 2026
• frappe hrms Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation CVE-2026-111389 Public exploit 8.3 HighOctober 16, 2026
• frappe hrms Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation CVE-2026-108733 5.3 MediumOctober 11, 2026
• frappe hrms Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount CVE-2026-108732 5.3 MediumOctober 11, 2026
• bradwenqiang hr Frappe HR Permission Validation __init__.py get_attendance_requests authorization CVE-2026-101006 5.3 MediumSeptember 28, 2026
• frappe hrms Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report CVE-2026-54524 7.1 HighSeptember 17, 2026
• frappe hrms Frappe HR: Permission Bypass in HRMS Leave Details API CVE-2026-45081 6.5 MediumMay 27, 2026
• frappe hr, hrms +1 more Frappe HR has possibility of SQL Injection due to improper field sanitization CVE-2026-41320 6.5 MediumApril 21, 2026
• frappe hr, hrms +1 more Frappe HR has Improper Access Control on Files CVE-2026-40889 6.5 MediumApril 21, 2026
• frappe hr, hrms +1 more Frappe HR vulnerable to Improper Access Control CVE-2026-40888 6.5 MediumApril 21, 2026
• frappe hrms pbrong hrms recruitment.go UpdateRecruitmentById cross site scripting CVE-2026-1161 5.1 MediumJanuary 19, 2026
• frappe hrms pbrong hrms resource.go HrmsDB improper authorization CVE-2025-1815 6.9 MediumMarch 2, 2025