CVE-2026-55796CWE-89sql-injection

CVE-2026-55796

Medium · published October 17, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
16.7
In the wild
Unconfirmed
What it is

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-17T01:19Z
References (5)
https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6 · [email protected]https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66 · [email protected]https://github.com/frappe/hrms/releases/tag/v15.60.3 · [email protected]https://github.com/frappe/hrms/releases/tag/v16.7.1 · [email protected]https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr · [email protected]
EPSS history
Timeline
  • 18 OCT 03:30Z
    EPSS moved — → 0%
    epss
  • 16 OCT 20:50Z
    Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
    cvelistv5
  • 16 OCT 20:50Z
    Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
    cvelistv5