https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-13T18:52:57.577900+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-108732 fkie_cve-2026-108732 2026-10-13T18:52:57.646141+00:00

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.

 https://db.gcve.eu/vuln/ghsa-f4w9-fc3h-w6qm GHSA-f4w9-fc3h-w6qm 2026-10-13T18:52:57.646290+00:00

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.