CVE-2026-41320

OVERVIEW CVE-2026-41320 is a SQL injection vulnerability affecting Frappe HR, an open-source human resources management system. The vulnerability exists in a specific endpoint that accepts specially crafted requests, potentially allowing attackers to extract sensitive information from the database. Versions 15.54.0 and 14.38.1 and later contain patches for this issue. SEVERITY This vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and authenticated access. The threat actor must have valid credentials to exploit the vulnerability, but no user interaction is required. The primary impact is confidentiality loss, as attackers can extract information they would not normally access. Integrity and availability of the system are not affected. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by its absence from the Known Exploited Vulnerabilities catalog. The EPSS score of 0.00033 suggests minimal probability of exploitation within the next 30 days. The vulnerability has received limited community attention and carries a relatively low FAUCET Risk Score of 35/100, indicating this is not a priority threat. No workarounds are available, making prompt patching the recommended mitigation strategy.