CVE-2026-55796

MEDIUM 6.5

Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.

CWE	CWE-89
Vendor	frappe
Product	hrms
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for frappe hrms

Be the first to know when new medium vulnerabilities affecting frappe hrms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

frappe / hrms

< 15.60.3 >= 16.0.0, < 16.7.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr github.com: https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6 github.com: https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66 github.com: https://github.com/frappe/hrms/releases/tag/v15.60.3 github.com: https://github.com/frappe/hrms/releases/tag/v16.7.1