CVE-2025-11283

LOW

Frappe LMS 2.35.0 - Cross-Site Scripting via Course Description Handler

Title source: llm
STIX 2.1

Description

A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.327017
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.327017
Exploit, Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.659697

Scores

CVSS v3 2.4
EPSS 0.0037
EPSS Percentile 28.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
frappe/learning 2.35.0
Published Oct 05, 2025
Tracked Since Feb 18, 2026