CVE-2025-67730
MEDIUMFrappe Learning Management System 2.0.0-2.41.9 - Stored XSS via Job Course and Batch Description
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-67730. PoCs published by Dharan10.
AI-analyzed exploit summary This repository contains a detailed writeup for CVE-2025-67730, a stored XSS vulnerability affecting Job, Course, and Batch description fields in an unspecified software. The PoC demonstrates how an authenticated attacker can inject malicious JavaScript payloads that execute in the context of other users' browsers.
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.
Exploits (1)
This repository contains a detailed writeup for CVE-2025-67730, a stored XSS vulnerability affecting Job, Course, and Batch description fields in an unspecified software. The PoC demonstrates how an authenticated attacker can inject malicious JavaScript payloads that execute in the context of other users' browsers.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N