CVE-2026-34606

MediumCVSS 6.1

Published: 02/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

Frappe LMS is vulnerable to stored Cross-Site Scripting (XSS). The vulnerability affects versions from 2.27.0 to before 2.48.0.

Risk Assessment

An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or data exfiltration.

Recommendation

Update Frappe LMS to version 2.48.0, which contains the fix.

Original NVD description (English source)

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.