Home

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript when rendered on course or jobs pages.

PUBLISHED Reserved 2026-01-13 | Published 2026-01-14 | Updated 2026-01-14 | Assigner GitHub_M




LOW: 1.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

<= 2.44.0
affected

References

github.com/...pe/lms/security/advisories/GHSA-78mq-3whw-69j5

github.com/...ommit/e7ccf0a711d0e0ab5e6b28b7a1e4e0510b6b9543

cve.org (CVE-2026-23497)

nvd.nist.gov (CVE-2026-23497)

Download JSON