CVE-2025-67730
MEDIUMFrappe Learning < 2.42.0 - XSS
Title source: ruleDescription
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.
Exploits (1)
Scores
CVSS v3
5.4
EPSS
0.0005
EPSS Percentile
16.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
frappe/learning
2.0.0 - 2.42.0
Published
Dec 12, 2025
Tracked Since
Feb 18, 2026