Frappe LMS is Missing Server-Side Authorization in Business Logic

Stored XSS in Frappe LMS

A vulnerability was found in Frappe LMS 2.34.x/2.35.0

Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4

Frappe LMS: HTML injection in user-controlled metadata

Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages

Frappe Authenticated Users can Execute JavaScript through its Job Form

Frappe authenticated users can execute XSS through form description fields

Frappe LMS revoking access did not show immediate effect as roles were cached

Frappe Learning users were able to add HTML through input fields in the Job Form

Frappe Learning is a learning system that helps users structure their content

Frappe Learning Management System exposes details of unpublished courses to unauthorized users

Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students

Frappe Learning allowed students to access the Quiz Form via direct URL

Frappe Learning is a learning system that helps users structure their content

A vulnerability has been found in Frappe LMS 2.35.0

Frappe Learning Management System has Client-Side Manipulation of Quiz Scores

Frappe user was able to access the submission of other students