CVE-2026-55796

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.

• CWE-89

• https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6
• https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66
• https://github.com/frappe/hrms/releases/tag/v15.60.3
• https://github.com/frappe/hrms/releases/tag/v16.7.1
• https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr

Published

Oct 16, 2026

Last Modified

Oct 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55790Craft CMS is a content management system (CMS). In versions …7.4
• CVE-2026-55791Craft CMS is a content management system (CMS). Versions 4.0…6.9
• CVE-2026-55792Craft CMS is a content management system (CMS). In versions …6
• CVE-2026-55793Craft CMS is a content management system (CMS). In versions …5.9
• CVE-2026-55794Craft CMS is a content management system (CMS). In versions …8.7
• CVE-2026-55795Craft Commerce is an ecommerce platform for Craft CMS. From …6.9
• CVE-2026-55797Argo CD is a declarative, GitOps continuous delivery tool fo…8.8
• CVE-2026-55798Pillow is a Python imaging library. Prior to 12.3.0, Windows…4.5
• CVE-2026-55799Remote Code Execution Vulnerability in GraalScriptEngineCrea…9.8
• CVE-2026-5580A vulnerability was identified in CodeAstro Online Classroom…6.3
• CVE-2026-55803Improperly Controlled Modification of Dynamically-Determined…5.9
• CVE-2026-55804Improperly Controlled Modification of Dynamically-Determined…5.9