What’s Vulnerable › Products
frappe Learning vulnerabilities
22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.
Check whether your frappe Learning version is affected
Latest frappe Learning vulnerabilities
- CVE-2026-46546 — Frappe LMS: HTML injection in user-controlled metadata (CVSS 5.4)
- CVE-2026-39415 — Frappe Learning Management System has Client-Side Manipulation of Quiz Scores (CVSS 4.3)
- CVE-2026-34606 — Stored XSS in Frappe LMS (CVSS 6.1)
- CVE-2026-26977 — Frappe Learning Management System exposes details of unpublished courses to unauthorized users (CVSS 5.3)
- CVE-2026-26031 — Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students (CVSS 5.3)
- CVE-2026-23497 — Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages (CVSS 5.4)
- CVE-2025-67734 — Frappe Authenticated Users can Execute JavaScript through its Job Form (CVSS 5.4)
- CVE-2025-67730 — Frappe authenticated users can execute XSS through form description fields (CVSS 5.4)
- CVE-2025-66581 — Frappe LMS is Missing Server-Side Authorization in Business Logic (CVSS 6.5)
- CVE-2025-64707 — Frappe LMS revoking access did not show immediate effect as roles were cached (CVSS 5.4)
- CVE-2025-64705 — Frappe user was able to access the submission of other students (CVSS 4.3)
- CVE-2025-62779 — Frappe Learning users were able to add HTML through input fields in the Job Form (CVSS 5.4)
- CVE-2025-62778 — Frappe Learning allowed students to access the Quiz Form via direct URL (CVSS 5.3)
- CVE-2025-62158 — Frappe had attachments made by students to their assignments of type Text set to public (CVSS 5.3)
- CVE-2025-11283 — Frappe LMS Course cross site scripting (CVSS 2.4)
- CVE-2025-11282 — Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting (CVSS 6.1)
- CVE-2025-11281 — Frappe LMS Unpublished Course courses access control (CVSS 5.0)
- CVE-2025-11280 — Frappe LMS Assignment Picture files direct request (CVSS 3.7)
- CVE-2025-59415 — Frappe Learning vulnerable to Malicious Content upload via Profile bio field (CVSS 5.4)
- CVE-2025-55006 — Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature (CVSS 8.8)
- CVE-2023-5555 — Cross-site Scripting (XSS) - Generic in frappe/lms (CVSS 6.1)
- CVE-2023-42807 — Frappe LMS SQL Injection Issue on People Page (CVSS 9.8)