CVE-2026-54524

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54524
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54524.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54524
Aliases
  • GHSA-2gv7-x4h2-3737
Published
2026-09-17T18:33:37Z
Modified
2026-09-19T03:46:33Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
Details

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54524.json"
}
References

Affected packages

Git / github.com/frappe/hrms

Affected ranges

Type
GIT
Repo
https://github.com/frappe/hrms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b16148531954531a448dafdff20dc61882430ee9
Fixed
a29cc8875aab1f22707b011568f5f1f190861fc8
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.7.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v16.*
v16.0.0
v16.0.0-beta.1
v16.0.0-beta.2
v16.0.0-rc.1
v16.0.1
v16.0.2
v16.1.0
v16.2.0
v16.3.0
v16.3.1
v16.4.0
v16.4.1
v16.4.2
v16.4.3
v16.4.4
v16.4.5
v16.4.6
v16.4.7
v16.4.8
v16.5.0
v16.5.1
v16.5.2
v16.5.3
v16.5.4
v16.6.0
v16.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54524.json"