Critical severity · published Sep 21, 2023
CVE-2023-42807
Frappe LMS is an open source learning management system
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Learning · Frappe
through 1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-42807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-42807
Third Party Advisory
https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63
More from Learning
8.8
CVE-2025-55006
Frappe Learning is a learning system that helps users structure their content
6.5
CVE-2025-66581
Frappe LMS is Missing Server-Side Authorization in Business Logic
6.1
CVE-2026-34606
Stored XSS in Frappe LMS
6.1
CVE-2025-11282
A vulnerability was found in Frappe LMS 2.34.x/2.35.0
6.1
CVE-2023-5555
Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4