CVE-2023-42807CWE-89

Frappe LMS SQL Injection Issue on People Page

Medium · published September 21, 2023

CVSS v3.1
6.3
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-09-21T16:37Z
EPSS history
Timeline
  • 21 SEP 16:37Z
    Frappe LMS SQL Injection Issue on People Page
    cvelistv5