A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
Fix
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 1.9 · frappeNVD modified 2026-10-09 10:10
Affected (CPE criteria) 1
cpe:2.3:a:frappe:learning:*:*:*:*:*:*:*:*
References 8
- https://gist.github.com/0xHamy/c2a81f2d1c779c513fa3db6f3ad24544#steps-to-reproduce Exploit, Third Party Advisory
- https://github.com/frappe/lms/
- https://github.com/frappe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr Vendor Advisory
- https://vuldb.com/?ctiid.327016 Permissions Required, VDB Entry
- https://vuldb.com/?id.327016 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.659696 Exploit, Third Party Advisory, VDB Entry
- https://gist.github.com/0xHamy/c2a81f2d1c779c513fa3db6f3ad24544#steps-to-reproduce Exploit, Third Party Advisory
- https://vuldb.com/?submit.659696 Exploit, Third Party Advisory, VDB Entry