EUVD-2026-20603Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Server-side security enforcement
|
| Impact | This vulnerability presents a moderate and targeted risk profile. The CVSS 5.3 score reflects a low-impact (Integrity violation only, VC:N/VI:L/VA:N) vulnerability requiring network access and authenticated privileges (PR:L), with low attack complexity (AC:L). The CVSS vector confirms no confidentiality or availability impact, and the description explicitly states no privilege escalation or unauthorized access to other accounts is possible. From a real-world perspective, this is a data integrity issue confined to an authenticated user's own quiz submissions-a significant problem for academic institutions relying on quiz scores for assessment, but not a critical infrastructure vulnerability. The lack of any reported active exploitation (no KEV status, no identified POC) and the availability of a patched version (2.46.0) further reduces immediate urgency, though the ease of exploitation (simple browser tools, no special complexity) suggests motivated insiders in educational settings could abuse this rapidly if not patched. Organizations using Frappe LMS for high-stakes assessment should prioritize patching; those using it for low-stakes formative quizzes may deprioritize. |
| Exploit ScenarioDerived | An authenticated student opens a Frappe LMS quiz, answers questions, and uses browser developer tools (F12 → Console or Network tab) to intercept and modify the quiz submission JSON payload before it reaches the server, changing their score from 40% to 100%. The student submits the modified request, and the server, lacking server-side score validation, records the falsified score in the learning record. No elevated privileges, social engineering, or technical complexity is required-only knowledge of basic web debugging, making this exploitable by most users with basic technical literacy. This affects academic integrity and could influence grades, transcripts, and certification outcomes. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Frappe Learning Management System versions prior to 2.46.0 allow authenticated students to modify their own quiz scores via client-side manipulation using browser developer tools before submission. This vulnerability compromises the integrity of quiz results and academic reliability without enabling privilege escalation, unauthorized account access, or exposure of confidential information. The fix is available in version 2.46.0, and no public exploit code or active exploitation has been identified at the time of analysis.
RemediationAI
Upgrade Frappe LMS to version 2.46.0 or later to apply the vendor-released patch. The fix implements server-side validation and recalculation of quiz scores, ensuring that submitted scores are verified against the correct answers on the server before being recorded, eliminating the ability for students to manipulate client-side calculations. Organizations unable to upgrade immediately should implement compensating controls such as restricting quiz submissions to monitored testing environments, disabling browser developer tools on assessment terminals, or requiring instructor review of anomalous score submissions. For detailed patch information and guidance, refer to the official GitHub security advisory at https://github.com/frappe/lms/security/advisories/GHSA-9573-68xq-hwrx.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Frappe LMS implements quiz scoring logic on the client side, calculating scores in JavaScript before transmission to the server. This architecture violates the fundamental security principle of never trusting client-supplied data for security-critical calculations. CWE-602 (Client-Side Enforcement of Server-Side Security) describes this root cause: the application enforces data validation and integrity checks only on the client, where they can be circumvented by an authenticated user with access to browser developer tools (console, network inspection, DOM manipulation). The vulnerability affects all versions of the Frappe LMS package (cpe:2.3:a:frappe:lms:*:*:*:*:*:*:*:*) prior to 2.46.0, as the server-side code does not independently verify quiz scores before recording them.
Know when Frappe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated scores, which can be altered using browser developer tools prior to sending the submission request. While this does not allow modification of other users’ data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability. This issue affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. This vulnerability is fixed in 2.46.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
Authenticated SQL injection in Frappe ERPNext through 15.89.0 allows low-privilege users to extract arbitrary database c
SQL injection in Frappe ERPNext through 15.89.0 lets an authenticated attacker with a valid session and access to the Pa
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 lets a user who can create or modify an A
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
Exploit-DB