CVE-2026-54524— Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
Quick assessment
Affected
frappe hrms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe HR 是一个开源的人力资源管理解决方案（HRMS）。在 16.7.0 版本之前，拥有“HR User”角色的已认证用户可以在“基于支付方式的薪资支付”（Salary Payments Based on Payment Mode）报表的筛选条件中注入 SQL。具体而言，在 文件中， 函数基于用户可控的值构建筛选子句，而 函数将这些子句拼接进字符串格式的 SQL 查询中，从而导致攻击者能够提取任意数据库数据。该问题已在 16.7.0 版本中修复。
Possible ATT&CK Techniques 5 AI
T1078 · Valid Accounts T1529.002 T1078.004 · Cloud Accounts T1190 · Exploit Public-Facing Application T1213 · Data from Information Repositories
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54524
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-54524
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54524
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54524 (1)
Vendor Advisories for CVE-2026-54524 (1)
IV. Related Vulnerabilities
Same product: hrms
-
CVE-2026-45081
Frappe HR: Permission Bypass in HRMS Leave Details API -
CVE-2026-41320
Frappe HR has possibility of SQL Injection due to improper f -
CVE-2026-40889
Frappe HR has Improper Access Control on Files -
CVE-2026-40888
Frappe HR vulnerable to Improper Access Control -
CVE-2026-1161
pbrong hrms recruitment.go UpdateRecruitmentById cross site
Same vendor: frappe
-
CVE-2026-54343
Frappe LMS: Path Traversal in SCORM File Serving -
CVE-2023-51769
Frappe 跨站脚本漏洞 -
CVE-2026-53761
Frappe CRM: Authentication Bypass via Logged Invitation Keys -
CVE-2026-82634
Frappe Framework Development Branch Incorrect Authorization -
CVE-2026-81731
Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link
Same weakness: CWE-89
-
CVE-2026-53557
SQLBot: Second-Order SQL Injection via Excel Datasource Lead -
CVE-2026-53556
SQLBot: Authenticated SQL Injection in previewData Resulting -
CVE-2026-93426
SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Bui -
CVE-2026-54597
ITFlow: Authenticated Time-Based Blind SQL Injection in ITFl -
CVE-2026-54596
ITFlow: Authenticated SQL Injection via recurring_invoice_fr
V. Comments for CVE-2026-54524
No comments yet