{"schema":"threatline.record/2","record":{"id":"GHSA-jfmr-9jv9-mrw4","aliases":["GHSA-jfmr-9jv9-mrw4"],"summary":"Possibility of SQL injection due to missing validation","details":"### Impact\n\nSome endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. Any authenticated user, including a low-privilege account, could exploit this.\n\n### Workarounds\n\nNo workaround available; upgrading is required.","categories":["Unclassified"],"product":"hrms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4","source_modified_at":"2026-10-01T08:45:41Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"other","name":"hrms"},"range":">= 14.0.0, < 14.38.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4","source_modified_at":"2026-10-01T08:45:41Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"other","name":"hrms"},"range":">= 15.0.0, < 15.64.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4","source_modified_at":"2026-10-01T08:45:41Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"other","name":"hrms"},"range":">= 16.0.0, < 16.18.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4","source_modified_at":"2026-10-01T08:45:41Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"other","name":"hrms"},"version":"14.38.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4","source_modified_at":"2026-10-01T08:45:41Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"other","name":"hrms"},"version":"15.64.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4","source_modified_at":"2026-10-01T08:45:41Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"other","name":"hrms"},"version":"16.18.0"}],"cvss":7.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-01T08:45:41Z","modified_at":"2026-10-01T08:45:41Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-01T08:45:41Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-01T08:45:41Z","content_hash":"9010bf4dbe98b86a4d99ada3147aa7a7c0749ae32588f05ed54aa876420d39a9"}}