CVE-2025-62778CWE-425

CVE-2025-62778

Medium · published October 28, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Weakness
CWE-425 · Direct Request ('Forced Browsing')
Published
2025-10-28T02:15Z
Affected products (1)
ProductVersionsFixed in
frappe/learning≥ 2.0.0, < 2.39.22.39.2
References (2)
https://github.com/frappe/lms/commit/8749e21744547ae32f729bde05c854113e126750 · [email protected]https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx · [email protected]
EPSS history
Timeline
  • 27 OCT 21:16Z
    Frappe Learning allowed students to access the Quiz Form via direct URL
    cvelistv5