Vulnerability · Published Oct 16, 2026 · Assigned by GitHub_M

CVE-2026-55796Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report

Medium 6.5

In plain English

A medium-severity SQL injection in hrms from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 82.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.

Affected products (as reported)

Vendor	Product	Versions
frappe	hrms	< 15.60.3>= 16.0.0, < 16.7.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr x_refsource_CONFIRM
https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6 x_refsource_MISC
https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66 x_refsource_MISC
https://github.com/frappe/hrms/releases/tag/v15.60.3 x_refsource_MISC
https://github.com/frappe/hrms/releases/tag/v16.7.1 x_refsource_MISC