Frappe LMS is Missing Server-Side Authorization in Business Logic

Stored XSS in Frappe LMS

Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting

Frappe LMS: HTML injection in user-controlled metadata

Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages

Frappe Authenticated Users can Execute JavaScript through its Job Form

Frappe authenticated users can execute XSS through form description fields

Frappe LMS revoking access did not show immediate effect as roles were cached

Frappe Learning users were able to add HTML through input fields in the Job Form

Frappe Learning vulnerable to Malicious Content upload via Profile bio field

Frappe Learning Management System exposes details of unpublished courses to unauthorized users

Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students

Frappe Learning allowed students to access the Quiz Form via direct URL

Frappe had attachments made by students to their assignments of type Text set to public

Frappe LMS Unpublished Course courses access control

Frappe Learning Management System has Client-Side Manipulation of Quiz Scores

Frappe user was able to access the submission of other students