Vulnerability · Published Dec 12, 2025 · Assigned by GitHub_M

CVE-2025-67730Frappe authenticated users can execute XSS through form description fields

Medium 5.1

In plain English

A medium-severity cross-site scripting in lms from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.2%top 93.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.

Affected products (as reported)

Vendor	Product	Versions
frappe	lms	< 2.42.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/frappe/lms/security/advisories/GHSA-jjc4-j3hw-33h2 x_refsource_CONFIRM
https://github.com/frappe/lms/commit/0877e32e1bfe64831b875707241de1c449cda45c x_refsource_MISC