Cross-Site Scripting Vulnerability in Frappe Learning Management System (LMS)
CVE-2025-67734

5.1MEDIUM

Key Information:

Vendor

Frappe

Status
Lms
Vendor
CVE Published:
12 December 2025

What is CVE-2025-67734?

The Frappe Learning Management System (LMS) prior to version 2.42.0 is susceptible to a Cross-Site Scripting (XSS) vulnerability. Authenticated attackers can exploit this flaw through the Company Website field in the Job Form, injecting malicious JavaScript. This allows the executed script to run in the browsers of users who access the compromised job listing, potentially leading to data theft or further exploitation. Users are advised to upgrade to version 2.42.0 or later to mitigate this risk.

Affected Version(s)

lms < 2.42.0

References

https://github.com/frappe/lms/security/advisories/GHSA-c4...
x_refsource_CONFIRM
https://github.com/frappe/lms/commit/ca849da81558066d7614...
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-67734 : Cross-Site Scripting Vulnerability in Frappe Learning Management System (LMS)