תיאור (מקור, אנגלית)
A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
מוצרים מושפעים
frappe: learning
קישורים8
- github.com/frappe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr Vendor Advisory
- gist.github.com/0xHamy/c2a81f2d1c779c513fa3db6f3ad24544#steps-… ExploitThird Party Advisory
- vuldb.com/?submit.659696 ExploitThird Party AdvisoryVDB Entry
- gist.github.com/0xHamy/c2a81f2d1c779c513fa3db6f3ad24544#steps-… ExploitThird Party Advisory
- vuldb.com/?submit.659696 ExploitThird Party AdvisoryVDB Entry
- github.com/frappe/lms/
- vuldb.com/?ctiid.327016 Permissions RequiredVDB Entry
- vuldb.com/?id.327016 Third Party AdvisoryVDB Entry
מדדים
- CVSS 3.1
-
6.1
MEDIUM
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N - CVSS 4.0
-
1.9
LOW
מקור הציון: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — סבירות ניצול
- 0% אחוזון 34 · נכון ל-9 בנובמבר 2026
- CWE
- CWE-79CWE-94
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.