What’s Vulnerable › Products

frappe hrms vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your frappe hrms version is affected

Latest frappe hrms vulnerabilities

• CVE-2026-64862 — Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS (CVSS 6.5)
• CVE-2026-55796 — Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report (CVSS 6.5)
• CVE-2026-111389 — Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation (CVSS 7.7)
• CVE-2026-108733 — Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation (CVSS 4.3)
• CVE-2026-108732 — Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount (CVSS 4.3)
• CVE-2026-54524 — Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report (CVSS 7.1)
• CVE-2026-45081 — Frappe HR: Permission Bypass in HRMS Leave Details API (CVSS 6.5)