What is the CVSS score of CVE-2026-41320?

CVE-2026-41320 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41320?

Yes, a patch is available for CVE-2026-41320. Update the affected software to the latest version immediately.

Frappe HRMS CVE-2026-41320

EUVD-2026-24290 MEDIUM

SQL Injection (CWE-89)

2026-04-21 GitHub_M

SQLi Frappe Hrms

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Authenticated network access needed (PR:L, AV:N); impact confined to data read-out with no write or availability effect (C:H/I:N/A:N); no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:07 vuln.today

Patch released

Apr 27, 2026 - 19:38 nvd

Patch available

Apr 21, 2026 - 21:02 EUVD

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24290

CVE Published

Apr 21, 2026 - 19:34 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. Versions 15.54.0 and 14.38.1 contain a patch. No known workarounds are available.

AnalysisAI

SQL injection in Frappe HR (HRMS) exposes sensitive human resources data to authenticated remote attackers via a specially crafted request to an undisclosed endpoint. Affected installations running versions prior to 15.54.0 (v15 branch) or 14.38.1 (v14 branch) are vulnerable to unauthorized data extraction through unsanitized query parameters. No public exploit code has been identified and CISA KEV does not list this CVE; EPSS at 0.03% (10th percentile) and SSVC exploitation status of 'none' collectively indicate low current threat actor interest, though the C:H CVSS impact reflects meaningful data exposure risk for organizations handling employee records.

Technical ContextAI

Frappe HR (CPE: cpe:2.3:a:frappe:hrms:*:*:*:*:*:*:*:*) is an open-source HRMS built on the Frappe framework, which uses Python and typically a MariaDB/MySQL backend. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that attacker-controlled input is incorporated into a SQL query without adequate sanitization or parameterization, allowing injection of arbitrary SQL clauses. The advisory does not name the specific endpoint or parameter, which limits independent verification of the attack surface, but the pattern is consistent with application-layer query construction bypassing ORM protections for a particular feature - common in HRMS products where complex reporting or search endpoints construct dynamic queries.

RemediationAI

Upgrade Frappe HRMS to version 15.54.0 (v15 branch) or 14.38.1 (v14 branch), which contain the vendor-released patch per the GitHub Security Advisory GHSA-745c-5q8r-vgj2 at https://github.com/frappe/hrms/security/advisories/GHSA-745c-5q8r-vgj2. The vendor explicitly states no known workarounds are available, so patching is the only confirmed remediation path. As an interim risk reduction measure pending upgrade, organizations may consider restricting access to the HRMS application to trusted internal networks or VPN-only access, which reduces the attack surface for external threat actors - though this does not eliminate insider or compromised-credential threats. Access controls on HRMS user accounts should be reviewed to ensure principle of least privilege is enforced, limiting the pool of accounts that could be leveraged to exploit this issue.