frappe

Records318All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical20CVSS 9.0–10.0

CVSS high117CVSS 7.0–8.9

Exploited now

frappe records in CISA KEV

No frappe vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Erpnext 59 records HIGH Frappe 49 records HIGH Learning 22 records MEDIUM Frappe Hr 3 records LOW Frappe Crm 2 records HIGH Press 2 records LOW Helpdesk 1 record HIGH

Records

22 records in Learning · all components

TI-2025-10328 CVE-2025-11280 · GHSA-v97w-vr8h-fvmm

Frappe LMS Assignment Picture files direct request

MEDIUM 61

A flaw has been found in Frappe LMS 2.35.0.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00483 Published 2025-10-05 No fix listed CWE-425

TI-2023-05113 CVE-2023-5555 · GHSA-c447-v5h5-vwxf

Cross-site Scripting (XSS) - Generic in frappe/lms

MEDIUM 60

Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00506 Published 2023-10-12 Fixed in 5614a6203fb7d438be8e2b1e3030e4528d170ec4 CWE-79

TI-2025-10331 CVE-2025-11283 · GHSA-2p83-x3q3-65cc

Frappe LMS Course cross site scripting

MEDIUM 55

A vulnerability was determined in Frappe LMS 2.35.0.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00411 Published 2025-10-05 No fix listed CWE-79

TI-2025-10330 CVE-2025-11282 · GHSA-57c3-6898-289j

Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting

MEDIUM 55

A vulnerability was found in Frappe LMS 2.34.x/2.35.0.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00392 Published 2025-10-05 No fix listed CWE-79

TI-2025-10329 CVE-2025-11281 · GHSA-4jjv-8wpj-wqfg

Frappe LMS Unpublished Course courses access control

MEDIUM 45

A vulnerability has been found in Frappe LMS 2.35.0.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00366 Published 2025-10-05 No fix listed CWE-266

TI-2023-22898 CVE-2023-42807 · GHSA-m47x-32hh-m2m6

Frappe LMS SQL Injection Issue on People Page

MEDIUM 42

Frappe LMS is an open source learning management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00399 Published 2023-09-21 No fix listed CWE-89

TI-2025-34709 CVE-2025-55006

Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature

LOW 38

Frappe Learning is a learning system that helps users structure their content.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00291 Published 2025-08-09 No fix listed CWE-20

TI-2026-26853 CVE-2026-34606

Stored XSS in Frappe LMS

LOW 36

Frappe Learning Management System (LMS) is a learning system that helps users structure their content.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00208 Published 2026-04-02 Fixed in 2.48.0 CWE-79

TI-2026-21456 CVE-2026-26977

Frappe Learning Management System exposes details of unpublished courses to unauthorized users

LOW 36

Frappe Learning Management System (LMS) is a learning system that helps users structure their content.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2026-02-20 No fix listed CWE-284

TI-2026-28397 CVE-2026-39415

Frappe Learning Management System has Client-Side Manipulation of Quiz Scores

LOW 30

Frappe Learning Management System (LMS) is a learning system that helps users structure their content.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00272 Published 2026-04-08 Fixed in 2.46.0 CWE-602

TI-2025-36968 CVE-2025-59415

Frappe Learning vulnerable to Malicious Content upload via Profile bio field

LOW 24

Frappe Learning is a learning system that helps users structure their content.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0025 Published 2025-09-17 No fix listed CWE-79

TI-2025-41430 CVE-2025-67734

Frappe Authenticated Users can Execute JavaScript through its Job Form

LOW 22

Frappe Learning Management System (LMS) is a learning system that helps users structure their content.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00168 Published 2025-12-12 Fixed in 2.42.0 CWE-79

TI-2025-41426 CVE-2025-67730

Frappe authenticated users can execute XSS through form description fields

LOW 22

Frappe Learning Management System (LMS) is a learning system that helps users structure their content.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00172 Published 2025-12-12 Fixed in 2.42.0 CWE-79

TI-2026-21045 CVE-2026-26031

Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students

LOW 13

Frappe Learning Management System (LMS) is a learning system that helps users structure their content.

CVSS 4.0LOW 1.3 Network Low privileges No interaction EPSS 0.00211 Published 2026-02-11 Fixed in 2.44.0 CWE-863

TI-2025-38480 CVE-2025-62158

Frappe had attachments made by students to their assignments of type Text set to public

LOW 13

Frappe Learning is a learning system that helps users structure their content.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00285 Published 2025-10-10 Fixed in 2.38.0 CWE-200

TI-2026-34225 CVE-2026-46546

Frappe LMS: HTML injection in user-controlled metadata

LOW 10

Frappe Learning Management System (LMS) is a learning system that helps users structure their content.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00144 Published 2026-06-09 Fixed in 2.53.0 CWE-74

TI-2025-40051 CVE-2025-64705

Frappe user was able to access the submission of other students

LOW 8

Frappe Learning is a learning system that helps users structure their content.

CVSS 4.0LOW 1.3 Network Low privileges No interaction EPSS 0.0023 Published 2025-11-12 Fixed in 2.41.0 CWE-200

TI-2026-18930 CVE-2026-23497

Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages

LOW 7

Frappe Learning Management System (LMS) is a learning system that helps users structure their content.

CVSS 4.0LOW 1.3 Network No auth User interaction EPSS 0.0017 Published 2026-01-14 No fix listed CWE-79

TI-2025-40990 CVE-2025-66581

Frappe LMS is Missing Server-Side Authorization in Business Logic

LOW 7

Frappe Learning Management System (LMS) is a learning system that helps users structure their content.

CVSS 4.0LOW 1.3 Network Low privileges No interaction EPSS 0.00222 Published 2025-12-05 Fixed in 2.41.0 CWE-863

TI-2025-40053 CVE-2025-64707

Frappe LMS revoking access did not show immediate effect as roles were cached

LOW 7

Frappe Learning is a learning system that helps users structure their content.

CVSS 4.0LOW 1.2 Network High privileges No interaction EPSS 0.00178 Published 2025-11-12 Fixed in 2.41.0 CWE-863

TI-2025-38962 CVE-2025-62779

Frappe Learning users were able to add HTML through input fields in the Job Form

LOW 7

Frappe Learning is a learning system that helps users structure their content.

CVSS 4.0LOW 1.2 Network Low privileges User interaction EPSS 0.00184 Published 2025-10-27 No fix listed CWE-79

TI-2025-38961 CVE-2025-62778

Frappe Learning allowed students to access the Quiz Form via direct URL

LOW 7

Frappe Learning is a learning management system.

CVSS 4.0LOW 1.3 Network Low privileges No interaction EPSS 0.00216 Published 2025-10-27 No fix listed CWE-425

Open these records in search →