https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 23:08:55 +0000 https://db.gcve.eu/vuln/cve-2026-108732 <p><strong>Affected:</strong> frappe hrms</p> <p>Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees&#39; net pay and loan, advance, and claim balances.</p> <p><strong>Affected:</strong> frappe hrms</p> <p>Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees&#39; net pay and loan, advance, and claim balances.</p> https://db.gcve.eu/vuln/cve-2026-108732