CVE-2025-62779Medium· 5.4▾ SunlitFrappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input fields in the Job Form.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input fields in the Job Form.
learning >= 2.0.0, < 2.39.2Upgrade past the affected range:
learning 2.39.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11283Low· 2.4A vulnerability was determined in Frappe LMS 2.35.0
CVE-2025-11282Low· 2.4A vulnerability was found in Frappe LMS 2.34.x/2.35.0
CVE-2025-67734Medium· 5.4Frappe Learning Management System (LMS) is a learning system that helps users structure their content
CVE-2025-67730Medium· 5.4Frappe Learning Management System (LMS) is a learning system that helps users structure their content
CVE-2026-109673High· 7.3Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals
CVE-2026-109671High· 7.3Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages