CVE-2025-11282CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2025-11282

Low · published October 5, 2025

CVSS v3.1
2.4
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.

The record
Technical detail
CVSS v3.1
2.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.1th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-10-05T09:15Z
Affected products (1)
ProductVersionsFixed in
frappe/learning≥ 2.34.0, ≤ 2.35.0—
References (8)
https://gist.github.com/0xHamy/c2a81f2d1c779c513fa3db6f3ad24544#steps-to-reproduce · [email protected]https://github.com/frappe/lms/ · [email protected]https://github.com/frappe/lms/security/advisories/GHSA-mvxw-r9x4-3vrr · [email protected]https://vuldb.com/?ctiid.327016 · [email protected]https://vuldb.com/?id.327016 · [email protected]https://vuldb.com/?submit.659696 · [email protected]https://gist.github.com/0xHamy/c2a81f2d1c779c513fa3db6f3ad24544#steps-to-reproduce · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://vuldb.com/?submit.659696 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 OCT 04:32Z
    Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting
    cvelistv5