CVE-2026-61803Medium· 5.3▾ SunlitFrappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.
lms < 2.52.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61805Medium· 5.3Frappe LMS: Quiz result manipulation and cross-user submission forgery
CVE-2026-39375Medium· 5.1Frappe LMS has Stored XSS in Course Meta
CVE-2026-61806Medium· 5.3Frappe LMS allows unpublished certificate access
CVE-2026-112031Low· 3.5Chamilo LMS Ticket TicketManager.php addProject cross site scripting
CVE-2026-78532High· 7.1Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
CVE-2026-96777Medium· 6.3A vulnerability was determined in Forma LMS up to 4.1.43