Product by Frappe

    Hrms

    10 known vulnerabilities in Hrms (Frappe), 0 of them actively exploited (CISA KEV).

    Key figures

    10

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Hrms (Frappe)
    HighCVE-2026-54524

    Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report

    		—
    HighCVE-2026-111389

    Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

    		7.7
    MediumCVE-2026-55796

    Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report

    		6.5
    MediumCVE-2026-64862

    Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

    		6.5
    MediumCVE-2026-108732

    Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount

    		4.3
    MediumCVE-2026-108733

    Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation

    		4.3
    MediumCVE-2026-45081

    Frappe HR: Permission Bypass in HRMS Leave Details API

    		6.5
    MediumCVE-2026-40888

    Frappe HR vulnerable to Improper Access Control

    also in 1 other product

    		6.5
    MediumCVE-2026-40889

    Frappe HR has Improper Access Control on Files

    also in 1 other product

    		6.5
    MediumCVE-2026-41320

    Frappe HR has possibility of SQL Injection due to improper field sanitization

    also in 1 other product

    		6.5

    All products by Frappe