Description
A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
Affected products
frappe: learning
References8
- github.com/frappe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr Vendor Advisory
- gist.github.com/0xHamy/c2a81f2d1c779c513fa3db6f3ad24544#steps-t… ExploitThird Party Advisory
- vuldb.com/?submit.659696 ExploitThird Party AdvisoryVDB Entry
- gist.github.com/0xHamy/c2a81f2d1c779c513fa3db6f3ad24544#steps-t… ExploitThird Party Advisory
- vuldb.com/?submit.659696 ExploitThird Party AdvisoryVDB Entry
- github.com/frappe/lms/
- vuldb.com/?ctiid.327016 Permissions RequiredVDB Entry
- vuldb.com/?id.327016 Third Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N - CVSS 4.0
-
1.9
LOW
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 34 · as of 9 November 2026
- CWE
- CWE-79CWE-94
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.