CVE-2026-39375
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In Frappe Learning Management System (LMS) prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting.
Risk Assessment
Stored XSS may allow an attacker to execute malicious script in other users' browsers, potentially leading to session or data theft. However, this requires course editing privileges.
Recommendation
Update Frappe LMS to version 2.52.0 or later to fix the stored XSS vulnerability in meta tag fields.
Other vulnerabilities in Frappe Learning Management System (LMS)
See all- CVE-2026-61806Medium
In Frappe Learning Management System (LMS) prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access. This can expose certificate details belonging to other users. The issue does not allow modifying data or gaining elevated privileges.
- CVE-2026-61805Medium
In Frappe Learning Management System (LMS) prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts.
- CVE-2026-61803Medium
In Frappe Learning Management System (LMS) prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing. An authenticated user can complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue that does not expose other users' data or grant elevated privileges.
- CVE-2026-54343High
In Frappe Learning Management System (LMS) prior to 2.52.1, SCORMRenderer.render in lms/page_renderers.py constructs and opens a server-side path without confirming its real path remains within public/scorm. A remote attacker can read files outside the SCORM directory.
Original NVD description (English source)
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS