Teppay

**Name of the Vulnerable Software and Affected Versions** Frappe HR versions prior to 15.54.0 Frappe HR versions prior to 14.38.1 **Description** A specially crafted request sent to a specific endpoint can lead to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution, enabling an attacker to extract unauthorized information. **Recommendations** Update to version 15.54.0. Update to version 14.38.1.

**Name of the Vulnerable Software and Affected Versions** Plane versions prior to 1.2.2 **Description** A Server-Side Request Forgery (SSRF) flaw exists in the "Add Link" feature of Plane, allowing an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and retrieve the full response body. This can lead to the theft of sensitive data from internal services and cloud metadata endpoints. **Recommendations** Update to version 1.2.2 or later.