VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Apr 21, 2026· Updated Jun 17, 2026

CVE-2026-41320

CVE-2026-41320

Description

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. Versions 15.54.0 and 14.38.1 contain a patch. No known workarounds are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Frappe/Frappe Hr2 versions
    cpe:2.3:a:frappe:frappe_hr:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:frappe:frappe_hr:*:*:*:*:*:*:*:*range: <14.38.1
    • (no CPE)range: <15.54.0, <14.38.1
  • Frappe/HRllm-create
    Range: <15.54.0, <14.38.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.