hrms
- Software type
- Human resources
- Total vulnerabilities (90 days)
- 7
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, hrms recorded 7 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of hrms and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121442Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances APICVE-2026-64862Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMSCVE-2026-55796Frappe HR: SQL Injection in HRMS Salary Payments via ECS ReportCVE-2026-111389Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing ValidationCVE-2026-108733Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-121442Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API | Exploitation statusNot confirmed | FixYes |
| SeverityMedium |
CVE-2026-64862Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS | Exploitation statusNot exploited | FixYes | Published10/16/2026 | SeverityMedium |
|---|
CVE-2026-55796Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report | Exploitation statusNot exploited | FixYes | Published10/16/2026 | SeverityMedium |
|---|
CVE-2026-111389Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation | Exploitation statusNot exploited | FixYes | Published10/16/2026 | SeverityHigh |
|---|
CVE-2026-108733Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation | Exploitation statusNot exploited | FixYes | Published10/11/2026 | SeverityMedium |
|---|
CVE-2026-108732Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount | Exploitation statusActively exploited | FixYes | Published10/11/2026 | SeverityMedium |
|---|
CVE-2026-54524Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-45081Frappe HR: Permission Bypass in HRMS Leave Details API | Exploitation statusNot exploited | FixYes | Published05/27/2026 | SeverityMedium |
|---|
CVE-2026-41320Frappe HR has possibility of SQL Injection due to improper field sanitization | Exploitation statusNot exploited | FixNo | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-40889Frappe HR has Improper Access Control on Files | Exploitation statusNot exploited | FixNo | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-40888Frappe HR vulnerable to Improper Access Control | Exploitation statusNot exploited | FixNo | Published04/21/2026 | SeverityMedium |
|---|
11 Results | Page 1 of 1