github.com
https://github.com/frappe/lms/commit/0877e32e1bfe64831b875707241de1c449cda45c CVE-2025-67730
MEDIUM
Frappe authenticated users can execute XSS through form description fields
Record summary
CVE-2025-67730 has a selected CVSS score of 5.1 (medium); EIP currently links 1 repository PoC.
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.
Description source: CVE List
Exploitation context
Available material
- Repository PoCs
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 18, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 2.42.0 | affected |
Proofs of concept
1Repository PoCs
GitHubDharan10/CVE-2025-67730Repository PoCby Dharan10Stars: 0Writeup1 file
Analysis
Technical assessment
A technical writeup describing CVE-2025-67730, a stored XSS vulnerability in Frappe LMS. It includes a single-line HTML/JavaScript payload as a proof-of-concept example within the documentation, but the artifact itself is a README file providing an overview, impact, attack scenario, root cause, and mitigation details.
Backdoor review
No backdoor observed in reviewed code
The artifact is a single README.md file documenting CVE-2025-67730, a stored XSS vulnerability in Frappe LMS. The file contains a standard HTML/JavaScript proof-of-concept payload and step-by-step reproduction instructions. No backdoor, deceptive payload, or concealed executable behavior is present.
ClassificationWriteup
Model confidence100%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact is a README.md file that provides a technical analysis of CVE-2025-67730, including an overview, impact, attack scenario, root cause, and mitigation. It contains a single line of HTML/JavaScript as a proof-of-concept example within the documentation, but the file itself is not executable exploit or scanner code. Its primary purpose is to document and explain the vulnerability, which classifies it as a writeup.
README.md:1-112Requirements
- Attacker must have a valid authenticated user account on the target Frappe LMS instance.
README.md:35
Observed behavior
- The document describes a stored XSS attack where an authenticated user injects malicious HTML/JavaScript into description fields of Job, Course, or Batch forms. The payload is saved and later executed in the browser of any user viewing the affected content.
README.md:9README.md:33-39 - A specific HTML payload is provided as an example: '"><img src=x onerror=alert(document.domain)>'.
README.md:46
Behaviors behind the backdoor verdict
Observables
- Xss Payload
- "><img src=x onerror=alert(document.domain)>This is the documented proof-of-concept payload for the described stored XSS vulnerability. It is presented as a code block within the README and is consistent with the CVE description.
README.md:46
What the analysis did not establish
- The evidence packet contains only the README.md file from the repository. No other source code, scripts, or configuration files were provided. The analysis is based solely on this documentation file.
- Review is limited to the single README.md file provided; no other repository files were inspected.
- Binary files were flagged as metadata-only and not analyzed, but none were identified in the artifact.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
References
2github.comConfirmation
https://github.com/frappe/lms/security/advisories/GHSA-jjc4-j3hw-33h2