Advisories · Technology
frappe lms.
Every CVE that names frappe lms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Frappe LMS allows unpublished certificate access
- frappe lms
- Broken access control
- CVSS 5.3 Medium
Frappe LMS: Quiz result manipulation and cross-user submission forgery
- frappe lms
- Broken access control
- CVSS 5.3 Medium
Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
- frappe lms
- Insecure deserialization
- CVSS 5.1 Medium
Frappe LMS has Stored XSS in Course Meta
- frappe lms
- Cross-site scripting (XSS)
- CVSS 8.7 High
Frappe LMS: Path Traversal in SCORM File Serving
- frappe lms
- Path traversal
- CVSS 7.1 High
Frappe LMS enrollment bypass in paid courses via unrelated batch
- frappe lms
- Authentication bypass
- CVSS 2.1 Low
Frappe LMS: HTML injection in user-controlled metadata
- frappe lms
- Other injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Frappe has Path Transversal via SCORM
- frappe lms
- Path traversal
- CVSS 5.3 Medium
Frappe Learning Management System has Client-Side Manipulation of Quiz Scores
- frappe lms
- CWE-602
- CVSS 6.9 Medium
Stored XSS in Frappe LMS
- frappe lms
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Frappe Learning Management System exposes details of unpublished courses to unauthorized users
- frappe lms
- Broken access control
- CVSS 1.3 Low
Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students
- frappe lms
- Broken access control
- CVSS 1.3 Low
Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages
- frappe lms
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Frappe Authenticated Users can Execute JavaScript through its Job Form
- frappe lms
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Frappe authenticated users can execute XSS through form description fields
- frappe lms
- Cross-site scripting (XSS)
- CVSS 1.3 Low
Frappe LMS is Missing Server-Side Authorization in Business Logic
- frappe lms
- Broken access control
- CVSS 1.2 Low
Frappe LMS revoking access did not show immediate effect as roles were cached
- frappe lms
- Broken access control
- CVSS 1.3 Low
Frappe user was able to access the submission of other students
- frappe lms
- Information disclosure
- CVSS 1.2 Low
Frappe Learning users were able to add HTML through input fields in the Job Form
- frappe lms
- Cross-site scripting (XSS)
- CVSS 1.3 Low
Frappe Learning allowed students to access the Quiz Form via direct URL
- frappe lms
- Broken access control
- CVSS 2.7 Low
Frappe had attachments made by students to their assignments of type Text set to public
- frappe lms
- Information disclosure
- CVSS 4.8 Medium
Frappe LMS Course cross site scripting
- Frappe LMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting
- Frappe LMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 2.3 Low
Frappe LMS Unpublished Course courses access control
- Frappe LMS
- Privilege escalation
- Broken access control
- CVSS 6.3 Medium
Frappe LMS Assignment Picture files direct request
- Frappe LMS
- Broken access control
- CVSS 4.6 Medium
Frappe Learning vulnerable to Malicious Content upload via Profile bio field
- frappe lms
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
- frappe lms
- CWE-20
- CVSS 7.1 High
Cross-site Scripting (XSS) - Generic in frappe/lms
- frappe/lms
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Frappe LMS SQL Injection Issue on People Page
- frappe lms
- SQL injection