EUVD-2026-18462Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.
AnalysisAI
Stored cross-site scripting (XSS) in Frappe Learning Management System versions 2.27.0 through 2.47.x allows unauthenticated remote attackers to inject and persist malicious scripts that execute in the browsers of other users. The vulnerability affects content structure functionality and has been patched in version 2.48.0. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
Frappe LMS is a web-based learning platform built on the Frappe framework that manages educational content and course structure. The vulnerability stems from improper input validation and output encoding in content handling mechanisms (CWE-79: Improper Neutralization of Input During Web Page Generation). The stored XSS flaw allows attackers to bypass input sanitization and inject malicious JavaScript that persists in the application database, affecting all users who subsequently view the compromised content. The affected product is identified by CPE cpe:2.3:a:frappe:lms:*:*:*:*:*:*:*:* covering all versions in the affected range.
RemediationAI
Vendor-released patch: Frappe LMS version 2.48.0 or later. Organizations should upgrade immediately by pulling the latest release from https://github.com/frappe/lms/releases/tag/v2.48.0 or by updating through their package management system. The patch implements proper input validation and output encoding across content structure fields, as documented in upstream pull request https://github.com/frappe/lms/pull/2185 and commit b8283860a7f029ea2fa0245131c398c079088921. No workarounds are available prior to patching; input validation at the application layer cannot fully compensate for a stored XSS in persistent content. Administrators should verify the upgrade by checking the installed version and reviewing server logs for any suspicious content modifications during the affected version timeframe.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today