EUVD-2026-102570

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-111389

The Frappe HRMS software contains a SQL injection vulnerability in several endpoints across versions 14.x before 14.38.2 , 15.x before 15.64.0 , and 16.x before 16.18.0 . The root cause is missing input validation , which allows an authenticated attacker (including those with low-privilege accoun...

CVE-2026-45081

Frappe HR is an open-source human resources management solution HRMS. Prior to 16.5.0, authenticated employees could access other employees’ leave details due to improper authorization checks. This vulnerability is fixed in 16.5.0...

PT-2026-34059

Frappe HR is an open-source human resources management solution HRMS. Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files by exploiting certain api endpoint. Versions 15.58.2 and 16.4.2 contain a patch. No known workarounds are available...