{"id":"CVE-2026-111389","summary":"Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation","details":"Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.","aliases":["GHSA-jfmr-9jv9-mrw4"],"modified":"2026-10-17T02:30:54.860931716Z","published":"2026-10-16T01:17:57.752Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111389.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111389.json"},{"type":"ADVISORY","url":"https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111389"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/frappe-hrms-14.0.0-before-14.38.2-sql-injection-via-missing-validation"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/frappe/hrms","events":[{"introduced":"0dd84c291e7af71b4f484422d1b94c38ba509150"},{"fixed":"7e7855a529b1a3bad44e0d4dd207cc6435215b10"},{"introduced":"d7a4769bf4786b5a244b5b1a77b6be9ddf0547b3"},{"fixed":"6091df8b7aa7bb1e9a6952171daa8887b812b766"},{"introduced":"19a835b7ca10132365a8707931d65381aa68a846"},{"fixed":"1307a4f0b55eba6f447bbf6d23560616c075249d"}],"database_specific":{"extracted_events":[{"introduced":"14.0.0"},{"fixed":"14.38.2"},{"introduced":"15.0.0"},{"fixed":"15.64.0"},{"introduced":"16.0.0"},{"fixed":"16.18.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v14.38.1","v15.63.4","v16.17.1","v15.63.3","v16.17.0","v16.16.0","v15.63.2","v16.15.0","v16.14.0","v15.63.1","v16.13.0","v15.63.0","v16.12.2","v15.62.2","v16.12.1","v15.62.1","v16.12.0","v16.11.0","v15.62.0","v16.10.1","v16.10.0","v15.61.0","v16.9.0","v15.60.4","v16.8.0","v16.4.0","v16.7.1","v15.60.3","v15.60.2","v16.7.0","v16.6.1","v15.60.1","v16.6.0","v15.60.0","v16.5.4","v15.59.2","v16.5.3","v15.59.1","v16.5.2","v16.5.1","v16.5.0","v15.59.0","v15.58.8","v16.4.8","v14.38.0","v15.58.7","v16.4.7","v16.4.6","v15.58.6","v15.58.5","v16.4.5","v16.4.4","v15.58.4","v15.58.3","v16.4.3","v15.58.2","v16.4.2","v16.4.1","v15.58.1","v15.58.0","v15.57.1","v16.3.1","v16.3.0","v15.57.0","v16.2.0","v15.56.0","v15.55.0","v16.1.0","v16.0.2","v16.0.1","v16.0.0","v15.54.3","v15.54.2","v15.54.1","v15.54.0","v15.53.0","v15.52.5","v14.37.13","v15.52.4","v15.52.3","v15.52.2","v15.52.1","v15.52.0","v15.51.0","v14.37.12","v15.50.3","v15.50.2","v15.50.1","v15.50.0","v14.37.11","v15.49.2","v14.37.10","v15.49.1","v15.49.0","v14.37.9","v14.37.8","v15.48.1","v15.48.0","v15.47.8","v14.37.7","v15.47.7","v14.37.6","v15.47.6","v15.47.5","v14.37.5","v15.47.4","v15.47.3","v14.37.4","v14.37.3","v15.47.2","v15.47.1","v15.47.0","v15.46.1","v15.46.0","v15.45.3","v14.37.2","v15.45.2","v14.37.1","v15.45.1","v15.45.0","v14.37.0","v14.36.12","v15.44.2","v15.44.1","v15.44.0","v14.36.11","v15.43.1","v14.36.10","v15.43.0","v15.42.3","v15.42.2","v14.36.9","v15.42.1","v15.42.0","v15.41.0","v14.36.8","v15.40.0","v14.36.7","v15.39.2","v15.39.1","v14.36.6","v15.39.0","v14.36.5","v15.38.3","v14.36.4","v15.38.2","v14.36.3","v15.38.1","v14.36.2","v15.38.0","v15.37.2","v14.36.1","v15.37.1","v14.36.0","v14.35.4","v15.37.0","v15.36.1","v15.36.0","v14.35.3","v15.35.3","v14.35.2","v14.35.1","v15.35.2","v15.35.1","v14.35.0","v15.35.0","v15.34.0","v15.33.2","v14.34.2","v14.34.1","v15.33.1","v15.33.0","v14.34.0","v15.32.2","v15.32.1","v15.32.0","v15.31.0","v14.33.0","v15.30.0","v14.32.0","v14.31.0","v15.29.0","v14.30.1","v15.28.3","v15.28.2","v15.28.1","v15.28.0","v15.27.2","v15.27.1","v15.27.0","v14.30.0","v15.26.0","v14.29.3","v15.25.2","v15.25.1","v14.29.2","v14.29.1","v15.25.0","v15.24.0","v14.29.0","v15.23.1","v14.28.8","v15.23.0","v14.28.7","v15.22.3","v14.28.6","v15.22.2","v14.28.5","v15.22.1","v14.28.4","v15.22.0","v14.28.3","v14.28.2","v15.21.2","v15.21.1","v14.28.1","v15.21.0","v14.28.0","v15.20.3","v14.27.1","v15.20.2","v14.27.0","v14.26.2","v15.20.1","v15.20.0","v14.26.1","v15.19.0","v14.26.0","v15.18.0","v15.17.0","v14.25.0","v15.16.0","v14.24.2","v15.15.0","v15.14.2","v14.24.1","v14.24.0","v15.14.1","v15.14.0","v15.13.1","v14.23.0","v15.13.0","v14.22.1","v15.12.0","v14.22.0","v15.11.1","v14.21.6","v15.11.0","v14.21.5","v15.10.0","v14.21.4","v14.21.3","v15.9.2","v14.21.2","v15.9.1","v14.21.1","v15.9.0","v15.8.0","v14.21.0","v15.7.1","v14.20.1","v15.7.0","v14.20.0","v15.6.0","v14.19.0","v15.5.0","v14.18.1","v15.4.1","v15.4.0","v14.18.0","v15.3.0","v14.17.0","v15.2.0","v14.16.1","v14.16.0","v15.1.0","v14.15.0","v15.0.0","v14.14.0","v14.13.1","v14.13.0","v14.12.1","v14.12.0","v14.11.1","v14.11.0","v14.10.6","v14.10.5","v14.10.4","v14.10.3","v14.10.2","v14.10.1","v14.10.0","v14.9.0","v14.8.0","v14.7.0","v14.6.2","v14.6.1","v14.6.0","v14.5.1","v14.5.0","v14.4.5","v14.4.4","v14.4.3","v14.4.2","v14.4.1","v14.4.0","v14.3.4","v14.3.3","v14.3.2","v14.3.1","v14.3.0","v14.2.4","v14.2.3","v14.2.2","v14.2.1","v14.2.0","v14.1.3","v14.1.2","v14.1.1","v14.1.0","v14.0.3","v14.0.2","v14.0.1","v14.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111389.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"}]}