Frappe HRMS: SQL injection via missing input validation
Summary
Frappe HRMS, an open-source human resources management system, contains an SQL injection flaw in some endpoints caused by missing input validation (CVSS 4.0: 8.3). Any authenticated user, including a low-privilege account, can send crafted requests to extract sensitive information from the database, potentially including personal and salary data. Exploitation requires a valid login but no user interaction.
Affected
- Frappe HRMS 14.0.0 to before 14.38.2
- Frappe HRMS 15.0.0 to before 15.64.0
- Frappe HRMS 16.0.0 to before 16.18.0
- Whether 13.x and older releases are affected: Unknown.
Fixed in
- 14.38.2
- 15.64.0
- 16.18.0
- Use the latest patch release of each branch.
Workaround
No vendor workaround documented; upgrading is required. Third-party guidance (VulDB) suggests a Web Application Firewall at the network perimeter as a temporary compensating control only.
Exploitation
- A public proof-of-concept repository is listed; it is unverified and reportedly AI-generated.
- VulDB states no exploit is available and marks the status as 0-day; this conflict is unresolved.
- CISA SSVC: exploitation none. No active exploitation found. The CISA KEV catalogue was not specifically checked.
Our recommendation
- Identify all Frappe HRMS instances and their versions.
- Patch to 14.38.2, 15.64.0 or 16.18.0, or later.
- Until patched, restrict HRMS access to the internal network or VPN and review which accounts have access.
- Review application and database logs for unusual query parameters and unexpected data access.
- Check the whole HRMS version against the latest release, as other HRMS flaws were fixed in 2026 (CVE-2026-55796, CVE-2026-64862).
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
Syscallh00k/CVE-2026-111389
Research sources
- GitHub Security Advisory GHSA-jfmr-9jv9-mrw4 github.com
- VulnCheck advisory www.vulncheck.com
- CVE record via Vulners vulners.com
- VulDB entry 421036 vuldb.com
- Strix CVE entry www.strix.ai
- CVSS 4.0 data via ThreatInt cve.threatint.com
- Frappe HRMS release v16.18.0 (newreleases.io) newreleases.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:40.
Original description (NVD)
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.