Login Request a demo
Medium severity · published Oct 5, 2025
CVE-2025-11282
A vulnerability was found in Frappe LMS 2.34.x/2.35.0
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Learning · Frappe
2.34.0 through 2.35.0 · source: NVD
Affected product
LE
Learning
Frappe
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11282
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11282
Exploit
https://gist.github.com/0xHamy/c2a81f2d1c779c513fa3db6f3ad24544#steps-to-reproduce
github.com
https://github.com/frappe/lms/
Vendor Advisory
https://github.com/frappe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr
Permissions Required
https://vuldb.com/?ctiid.327016
Third Party Advisory
https://vuldb.com/?id.327016
Exploit
https://vuldb.com/?submit.659696
More from Learning
9.8
CVE-2023-42807
Frappe LMS is an open source learning management system
8.8
CVE-2025-55006
Frappe Learning is a learning system that helps users structure their content
6.5
CVE-2025-66581
Frappe Learning Management System (LMS) is a learning system that helps users structure their content
6.1
CVE-2026-34606
Stored XSS in Frappe LMS
6.1
CVE-2023-5555
Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4