Medium severity · published Dec 12, 2025
CVE-2025-67730
Frappe Learning Management System (LMS) is a learning system that helps users structure their content
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Learning · Frappe
2.0.0 before 2.42.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67730
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67730
Patch
https://github.com/frappe/lms/commit/0877e32e1bfe64831b875707241de1c449cda45c
Vendor Advisory
https://github.com/frappe/lms/security/advisories/GHSA-jjc4-j3hw-33h2
More from Learning
9.8
CVE-2023-42807
Frappe LMS is an open source learning management system
8.8
CVE-2025-55006
Frappe Learning is a learning system that helps users structure their content
6.5
CVE-2025-66581
Frappe Learning Management System (LMS) is a learning system that helps users structure their content
6.1
CVE-2026-34606
Stored XSS in Frappe LMS
6.1
CVE-2025-11282
A vulnerability was found in Frappe LMS 2.34.x/2.35.0