Medium severity · published Oct 16, 2026
CVE-2026-55796
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HR
hrms · frappe
< 15.60.3; >= 16.0.0, < 16.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55796
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55796
github.com
https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6
github.com
https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66
github.com
https://github.com/frappe/hrms/releases/tag/v15.60.3
github.com
https://github.com/frappe/hrms/releases/tag/v16.7.1
github.com
https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr
More from hrms
7.7
CVE-2026-111389
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
7.1
CVE-2026-54524
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
6.5
CVE-2026-64862
Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
6.5
CVE-2026-45081
Frappe HR: Permission Bypass in HRMS Leave Details API
6.5
CVE-2026-41320
Frappe HR has possibility of SQL Injection due to improper field sanitization