CVE-2025-67734Medium· 5.4▾ SunlitFrappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0.
learning >= 2.0.0, < 2.42.0Upgrade past the affected range:
learning 2.42.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11283Low· 2.4A vulnerability was determined in Frappe LMS 2.35.0
CVE-2025-11282Low· 2.4A vulnerability was found in Frappe LMS 2.34.x/2.35.0
CVE-2025-62779Medium· 5.4Frappe Learning is a learning system that helps users structure their content
CVE-2025-67730Medium· 5.4Frappe Learning Management System (LMS) is a learning system that helps users structure their content
CVE-2026-109673High· 7.3Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals
CVE-2026-109671High· 7.3Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages