High severity · published Sep 17, 2026
CVE-2026-54524
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HR
hrms · frappe
< 16.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54524
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54524
github.com
https://github.com/frappe/hrms/commit/b16148531954531a448dafdff20dc61882430ee9
github.com
https://github.com/frappe/hrms/pull/4515
github.com
https://github.com/frappe/hrms/releases/tag/v16.7.0
github.com
https://github.com/frappe/hrms/security/advisories/GHSA-2gv7-x4h2-3737
More from hrms
7.7
CVE-2026-111389
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
6.5
CVE-2026-64862
Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
6.5
CVE-2026-55796
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
6.5
CVE-2026-45081
Frappe HR: Permission Bypass in HRMS Leave Details API
6.5
CVE-2026-41320
Frappe HR has possibility of SQL Injection due to improper field sanitization