Search
Search Results (8 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-26977 | 1 Frappe | 2 Learning, Lms | 2026-02-20 | 5.3 Medium |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release. | ||||
| CVE-2025-67730 | 1 Frappe | 3 Frappe, Frappe Lms, Learning | 2025-12-18 | 5.4 Medium |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0. | ||||
| CVE-2025-67734 | 1 Frappe | 3 Frappe, Frappe Lms, Learning | 2025-12-16 | 5.4 Medium |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0. | ||||
| CVE-2025-62778 | 1 Frappe | 3 Frappe, Frappe Lms, Learning | 2025-11-03 | 5.3 Medium |
| Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL. | ||||
| CVE-2025-62779 | 1 Frappe | 3 Frappe, Frappe Lms, Learning | 2025-11-03 | 5.4 Medium |
| Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input fields in the Job Form. | ||||
| CVE-2025-59415 | 1 Frappe | 3 Frappe, Frappe Lms, Learning | 2025-10-08 | 4.6 Medium |
| Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learning where the system did not adequately sanitize the content uploaded in the profile bio. Malicious SVG files could be used to execute arbitrary scripts in the context of other users. | ||||
| CVE-2023-5555 | 1 Frappe | 1 Learning | 2025-10-03 | 6.1 Medium |
| Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4. | ||||
| CVE-2023-42807 | 1 Frappe | 1 Learning | 2025-10-03 | 6.3 Medium |
| Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app. | ||||
Page 1 of 1.