CVE-2026-54524

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.7.0

Description An authenticated user with the HR User role can perform SQL injection through filters in the Salary Payments Based on Payment Mode report. The issue occurs in the salary payments based on payment mode.py file, where the get conditions() function constructs filter clauses from user-controlled values, and the get data() function incorporates these clauses into a string-formatted SQL query. This allows an attacker to extract arbitrary data from the database.

Recommendations Update to version 16.7.0.