CVE-2026-46546CWE-74

Frappe LMS: HTML injection in user-controlled metadata

Low · published June 9, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.53.0, an authenticated user could supply specially crafted content in certain user-editable fields that, when surfaced in page metadata, caused visitors' browsers to navigate to an attacker-chosen URL. This issue has been patched in version 2.53.0.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-06-09T23:54Z
EPSS history
Timeline
  • 09 JUN 23:54Z
    Frappe LMS: HTML injection in user-controlled metadata
    cvelistv5