CVE-2026-39375Medium· 5.1▾ SunlitFrappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.
lms < 2.52.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112031Low· 3.5Chamilo LMS Ticket TicketManager.php addProject cross site scripting
CVE-2026-78532High· 7.1Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
CVE-2026-61805Medium· 5.3Frappe LMS: Quiz result manipulation and cross-user submission forgery
CVE-2026-61806Medium· 5.3Frappe LMS allows unpublished certificate access
CVE-2026-61803Medium· 5.3Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
CVE-2026-109673High· 7.3Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals