All vulnerabilities
GHSA-jfmr-9jv9-mrw4

hrms: Possibility of SQL injection due to missing validation

hrms
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in14.38.2Also 15.64.0, 16.18.0GitHub
Published1 Oct 2026Updated 1 Oct 2026GitHub

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. Any authenticated user, including a low-privilege account, could exploit this.

Workarounds

No workaround available; upgrading is required.

Text from GitHub Advisory Database

Affected versions 3

  • hrms, other>= 14.0.0, < 14.38.2GitHub
  • hrms, other>= 15.0.0, < 15.64.0GitHub
  • hrms, other>= 16.0.0, < 16.18.0GitHub