CVE-2026-34606
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Frappe LMS is vulnerable to stored Cross-Site Scripting (XSS). The vulnerability affects versions from 2.27.0 to before 2.48.0.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or data exfiltration.
Recommendation
Update Frappe LMS to version 2.48.0, which contains the fix.
Other vulnerabilities in Frappe LMS
See all- CVE-2026-39405Critical
In Frappe Learning Management System (LMS) versions 2.50.0 and below, a user with course editing role can upload a SCORM ZIP package to write files outside the intended directory. Fixed in version 2.50.1.
- CVE-2026-39385High
Frappe LMS version 2.51.0 and earlier allows users to bypass payment validation for courses by using an unrelated batch. This is fixed in version 2.52.0.
- CVE-2026-39415Medium
Frappe Learning Management System (LMS) before version 2.46.0 allows students to modify quiz scores before submission. The application relies on client-side calculations that can be altered using browser developer tools, compromising score integrity.
- CVE-2025-66581Medium
Frappe Learning Management System (LMS) prior to 2.41.0 has a flaw in server-side authorization logic that allowed authenticated users to perform actions beyond their assigned roles across multiple features. Because affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server, users with low-privileged roles (such as students) could perform operations intended only for instructors or administrators via directly using the APIs. This vulnerability is fixed in 2.41.0.
Original NVD description (English source)
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS