Hrms
Monthly
SQL injection in Frappe HRMS 14.x (before 14.38.2), 15.x (before 15.64.0), and 16.x (before 16.18.0) allows any authenticated user, including a low-privilege account, to extract sensitive information from the database via crafted requests to endpoints that lack input validation. The flaw requires only a valid session (CVSS PR:L) and no user interaction, resulting in high confidentiality impact with scope change. Patched versions 14.38.2, 15.64.0, and 16.18.0 are available, and no public exploit code has been identified at time of analysis.
Frappe HRMS before 15.61.0 allows any authenticated employee to read other employees' expense advance records by querying the Expense Claim Advances API, which fails to enforce ownership-based authorization (CWE-639). The exposure is limited to read access of sensitive financial data belonging to coworkers; there is no integrity or availability impact and an attacker must already hold valid employee credentials on the instance. A public advisory exists, no public exploit code has been identified at time of analysis, and this is tracked as a moderate-severity information-disclosure issue rather than an emergency.
Authenticated users of Frappe HRMS (Frappe HR) can read sensitive HR records belonging to other employees because the product's PWA employee-data API endpoints fail to enforce object-level authorization prior to versions 15.58.3 (15.x branch) and 16.4.3 (16.x branch). Rated CVSS 6.5 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is a read-only confidentiality breach: no integrity or availability impact, and it requires a valid employee-level session, so anonymous external attackers cannot exploit it. Exploitation only works where the deployment exposes the affected PWA endpoints; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. Vendor-released patch: 15.58.3 and 16.4.3.
SQL injection in the 'Salary Payments via ECS' report of Frappe HR (HRMS) lets an authenticated HR/payroll user read sensitive database records by supplying crafted report filter values. The vulnerability affects Frappe HR releases before 15.60.3 on the 15.x line and before 16.7.1 on the 16.x line, and is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); because the CVSS vector specifies PR:L, exploitation requires a valid low-privileged account and is therefore an insider or post-compromise vector rather than an anonymous remote attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is resolved by vendor patches 15.60.3 and 16.7.1.
Missing authorization in Frappe HR (hrms) lets any authenticated user - including ordinary employees with no HR role - zero out another employee's leave allocation by POSTing the target Leave Allocation record name to the whitelisted expire_allocation method, silently wiping that employee's remaining leave balance. The flaw affects all 14.x and 15.x releases through 15.64.3 and every build before 16.11.0, is exploitable in the default configuration with only a low-privileged session and no victim interaction, and is confined to data integrity (no confidentiality or availability impact). No public exploit identified at time of analysis, and a vendor-released patch (16.11.0) is available, so this is best treated as a medium-severity, insider-oriented data-integrity issue rather than a mass-exploitation emergency.
Authenticated users of Frappe HR (hrms) - including accounts holding no HR role whatsoever - can read other employees' net pay along with loan, advance, and expense-claim balances by calling the whitelisted get_account_and_amount method over /api/method. Affected releases are all 14.x and 15.x builds through 15.64.3, plus any pre-16.11.0 build; the endpoint ships whitelisted by default and requires no non-default configuration or user interaction, only a valid low-privileged session (CVSS 4.0 score 5.3, PR:L, confidentiality-only impact). Exploitation is a straightforward IDOR-style enumeration exercise because Salary Slip and claim document names are sequential and guessable, so an attacker can harvest amounts systematically; CISA KEV does not list this issue and no public exploit code has been confirmed, although a public technical writeup describing the payroll "amount oracle" is referenced in the advisory data, making the technique widely discoverable.
SQL injection in Frappe HR (HRMS) exposes sensitive human resources data to authenticated remote attackers via a specially crafted request to an undisclosed endpoint. Affected installations running versions prior to 15.54.0 (v15 branch) or 14.38.1 (v14 branch) are vulnerable to unauthorized data extraction through unsanitized query parameters. No public exploit code has been identified and CISA KEV does not list this CVE; EPSS at 0.03% (10th percentile) and SSVC exploitation status of 'none' collectively indicate low current threat actor interest, though the C:H CVSS impact reflects meaningful data exposure risk for organizations handling employee records.
Unauthorized file access in Frappe HRMS allows any authenticated user to retrieve files attached to documents they are not permitted to view by calling the attachment API endpoint without proper authorization enforcement. Affected versions span both the v15 branch (prior to 15.58.2) and v16 branch (prior to 16.4.2); patched releases are available from the vendor. No public exploit exists and EPSS is 0.03% (8th percentile), though the confidentiality impact is significant given that HR systems routinely store payroll records, employment contracts, and personal employee data.
Unauthorized employee data disclosure in Frappe HRMS allows any authenticated user holding only a default role to retrieve private employee fields via an insufficiently access-controlled API endpoint in the Roster shift assignment module. Affected versions span the v15 branch prior to 15.58.1 and the v16 branch prior to 16.4.1. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile), and CISA SSVC rates exploitation as none with partial technical impact.
SQL injection in Frappe HRMS 14.x (before 14.38.2), 15.x (before 15.64.0), and 16.x (before 16.18.0) allows any authenticated user, including a low-privilege account, to extract sensitive information from the database via crafted requests to endpoints that lack input validation. The flaw requires only a valid session (CVSS PR:L) and no user interaction, resulting in high confidentiality impact with scope change. Patched versions 14.38.2, 15.64.0, and 16.18.0 are available, and no public exploit code has been identified at time of analysis.
Frappe HRMS before 15.61.0 allows any authenticated employee to read other employees' expense advance records by querying the Expense Claim Advances API, which fails to enforce ownership-based authorization (CWE-639). The exposure is limited to read access of sensitive financial data belonging to coworkers; there is no integrity or availability impact and an attacker must already hold valid employee credentials on the instance. A public advisory exists, no public exploit code has been identified at time of analysis, and this is tracked as a moderate-severity information-disclosure issue rather than an emergency.
Authenticated users of Frappe HRMS (Frappe HR) can read sensitive HR records belonging to other employees because the product's PWA employee-data API endpoints fail to enforce object-level authorization prior to versions 15.58.3 (15.x branch) and 16.4.3 (16.x branch). Rated CVSS 6.5 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is a read-only confidentiality breach: no integrity or availability impact, and it requires a valid employee-level session, so anonymous external attackers cannot exploit it. Exploitation only works where the deployment exposes the affected PWA endpoints; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. Vendor-released patch: 15.58.3 and 16.4.3.
SQL injection in the 'Salary Payments via ECS' report of Frappe HR (HRMS) lets an authenticated HR/payroll user read sensitive database records by supplying crafted report filter values. The vulnerability affects Frappe HR releases before 15.60.3 on the 15.x line and before 16.7.1 on the 16.x line, and is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); because the CVSS vector specifies PR:L, exploitation requires a valid low-privileged account and is therefore an insider or post-compromise vector rather than an anonymous remote attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is resolved by vendor patches 15.60.3 and 16.7.1.
Missing authorization in Frappe HR (hrms) lets any authenticated user - including ordinary employees with no HR role - zero out another employee's leave allocation by POSTing the target Leave Allocation record name to the whitelisted expire_allocation method, silently wiping that employee's remaining leave balance. The flaw affects all 14.x and 15.x releases through 15.64.3 and every build before 16.11.0, is exploitable in the default configuration with only a low-privileged session and no victim interaction, and is confined to data integrity (no confidentiality or availability impact). No public exploit identified at time of analysis, and a vendor-released patch (16.11.0) is available, so this is best treated as a medium-severity, insider-oriented data-integrity issue rather than a mass-exploitation emergency.
Authenticated users of Frappe HR (hrms) - including accounts holding no HR role whatsoever - can read other employees' net pay along with loan, advance, and expense-claim balances by calling the whitelisted get_account_and_amount method over /api/method. Affected releases are all 14.x and 15.x builds through 15.64.3, plus any pre-16.11.0 build; the endpoint ships whitelisted by default and requires no non-default configuration or user interaction, only a valid low-privileged session (CVSS 4.0 score 5.3, PR:L, confidentiality-only impact). Exploitation is a straightforward IDOR-style enumeration exercise because Salary Slip and claim document names are sequential and guessable, so an attacker can harvest amounts systematically; CISA KEV does not list this issue and no public exploit code has been confirmed, although a public technical writeup describing the payroll "amount oracle" is referenced in the advisory data, making the technique widely discoverable.
SQL injection in Frappe HR (HRMS) exposes sensitive human resources data to authenticated remote attackers via a specially crafted request to an undisclosed endpoint. Affected installations running versions prior to 15.54.0 (v15 branch) or 14.38.1 (v14 branch) are vulnerable to unauthorized data extraction through unsanitized query parameters. No public exploit code has been identified and CISA KEV does not list this CVE; EPSS at 0.03% (10th percentile) and SSVC exploitation status of 'none' collectively indicate low current threat actor interest, though the C:H CVSS impact reflects meaningful data exposure risk for organizations handling employee records.
Unauthorized file access in Frappe HRMS allows any authenticated user to retrieve files attached to documents they are not permitted to view by calling the attachment API endpoint without proper authorization enforcement. Affected versions span both the v15 branch (prior to 15.58.2) and v16 branch (prior to 16.4.2); patched releases are available from the vendor. No public exploit exists and EPSS is 0.03% (8th percentile), though the confidentiality impact is significant given that HR systems routinely store payroll records, employment contracts, and personal employee data.
Unauthorized employee data disclosure in Frappe HRMS allows any authenticated user holding only a default role to retrieve private employee fields via an insufficiently access-controlled API endpoint in the Roster shift assignment module. Affected versions span the v15 branch prior to 15.58.1 and the v16 branch prior to 16.4.1. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile), and CISA SSVC rates exploitation as none with partial technical impact.