CVE-2025-11282
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in Frappe LMS 2.34.x/2.35.0 concerns an incomplete fix for CVE-2025-55006. Manipulation of an unknown function leads to cross-site scripting (XSS). The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
The risk for the organization is the possibility of remote script execution in the user's browser, which could lead to session theft or account takeover.
Recommendation
Update Frappe LMS to a version containing the full fix as soon as possible, as the current version is vulnerable to XSS attacks.
Other vulnerabilities in Frappe LMS
See all- CVE-2026-39405Critical
In Frappe Learning Management System (LMS) versions 2.50.0 and below, a user with course editing role can upload a SCORM ZIP package to write files outside the intended directory. Fixed in version 2.50.1.
- CVE-2026-39385High
Frappe LMS version 2.51.0 and earlier allows users to bypass payment validation for courses by using an unrelated batch. This is fixed in version 2.52.0.
- CVE-2026-39415Medium
Frappe Learning Management System (LMS) before version 2.46.0 allows students to modify quiz scores before submission. The application relies on client-side calculations that can be altered using browser developer tools, compromising score integrity.
- CVE-2026-34606Medium
Frappe LMS is vulnerable to stored Cross-Site Scripting (XSS). The vulnerability affects versions from 2.27.0 to before 2.48.0.
- CVE-2025-67734Medium
Frappe Learning Management System (LMS) prior to version 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0.
- CVE-2025-67730Medium
Frappe Learning Management System (LMS) prior to version 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.
- CVE-2025-66581Medium
Frappe Learning Management System (LMS) prior to 2.41.0 has a flaw in server-side authorization logic that allowed authenticated users to perform actions beyond their assigned roles across multiple features. Because affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server, users with low-privileged roles (such as students) could perform operations intended only for instructors or administrators via directly using the APIs. This vulnerability is fixed in 2.41.0.
- CVE-2025-11283Low
A vulnerability was determined in Frappe LMS 2.35.0 affecting an unknown function of the Course Handler component. Manipulation of the Description argument can lead to cross-site scripting (XSS). The attack can be executed remotely, and the exploit has been publicly disclosed and may be utilized.
- CVE-2025-11280Low
A vulnerability has been found in Frappe LMS 2.35.0 in an unknown function of the /files/ file of the Assignment Picture Handler component. The manipulation causes a direct request that can be initiated remotely. The attack complexity is rated as high and exploitability as difficult, but the exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS