Medium severity · published Dec 12, 2025
CVE-2025-67734
Frappe Learning Management System (LMS) is a learning system that helps users structure their content
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Learning · Frappe
2.0.0 before 2.42.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67734
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67734
Patch
https://github.com/frappe/lms/commit/ca849da81558066d7614b9b6234004ff59c90632
Third Party Advisory
https://github.com/frappe/lms/security/advisories/GHSA-c495-qg4v-5vr7
More from Learning
9.8
CVE-2023-42807
Frappe LMS is an open source learning management system
8.8
CVE-2025-55006
Frappe Learning is a learning system that helps users structure their content
6.5
CVE-2025-66581
Frappe Learning Management System (LMS) is a learning system that helps users structure their content
6.1
CVE-2026-34606
Stored XSS in Frappe LMS
6.1
CVE-2025-11282
A vulnerability was found in Frappe LMS 2.34.x/2.35.0