Approved changes feed: RSS · Atom
cpe:2.3:a:frappe:learning:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Frappe (a51f8b94-1fb6-5e30-97d7-fbeb544c71ba) |
|---|---|
| Product | Learning (4359151d-0f29-56c1-b013-1e9ac8769982) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/frappe/lms |
purl2cpe | 2026-06-01 10:17:01.009404 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-39415 |
vulnerable | 2026-06-08 08:01:16.479102 |
Frappe Learning Management System has Client-Side Manipulation of Quiz Scores
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated scores, which can be altered using browser developer tools prior to sending the submission request. While this does not allow modification of other users’ data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability. This issue affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. This vulnerability is fixed in 2.46.0.
Published: 2026-04-08T20:07:45.729Z
Updated: 2026-04-09T13:52:12.103Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34606 |
vulnerable | 2026-06-08 07:59:12.751200 |
Stored XSS in Frappe LMS
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.
Published: 2026-04-02T17:50:01.153Z
Updated: 2026-04-03T13:02:34.097Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26977 |
vulnerable | 2026-06-08 07:53:21.790790 |
Frappe Learning Management System exposes details of unpublished courses to unauthorized users
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.
Published: 2026-02-20T00:56:42.680Z
Updated: 2026-02-20T15:35:48.470Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26031 |
vulnerable | 2026-06-08 07:53:20.747312 |
Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0.
Published: 2026-02-11T21:32:15.323Z
Updated: 2026-02-12T15:40:20.046Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23497 |
vulnerable | 2026-06-08 07:51:15.534247 |
Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript when rendered on course or jobs pages.
Published: 2026-01-14T18:25:52.052Z
Updated: 2026-01-14T21:15:21.105Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-67734 |
vulnerable | 2026-06-08 07:41:20.385601 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-67730 |
vulnerable | 2026-06-08 07:41:20.379241 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66581 |
vulnerable | 2026-06-08 07:41:19.240933 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64707 |
vulnerable | 2026-06-08 07:39:20.183786 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64705 |
vulnerable | 2026-06-08 07:39:20.176243 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62779 |
vulnerable | 2026-06-08 07:39:16.624989 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62778 |
vulnerable | 2026-06-08 07:39:16.624454 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59415 |
vulnerable | 2026-06-08 07:35:21.867271 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55006 |
vulnerable | 2026-06-08 07:33:13.958535 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11282 |
vulnerable | 2026-06-08 07:02:28.538426 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-42807 |
vulnerable | 2026-06-08 06:11:09.532975 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.