CVE-2026-34606

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.

PUBLISHED Reserved 2026-03-30 | Published 2026-04-02 | Updated 2026-04-03 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...pe/lms/security/advisories/GHSA-qf5w-r34q-c7j2

github.com/frappe/lms/pull/2185

github.com/...ommit/b8283860a7f029ea2fa0245131c398c079088921

github.com/frappe/lms/releases/tag/v2.48.0

cve.org (CVE-2026-34606)

nvd.nist.gov (CVE-2026-34606)

Download JSON