Skip to content
Frappe Lms vulnerabilities
-
frappe lms
Frappe LMS allows unpublished certificate access
CVE-2026-61806
5.3 Medium
-
frappe lms
Frappe LMS: Quiz result manipulation and cross-user submission forgery
CVE-2026-61805
5.3 Medium
-
frappe lms
Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
CVE-2026-61803
5.3 Medium
-
frappe lms
Frappe LMS has Stored XSS in Course Meta
CVE-2026-39375
5.1 Medium
-
chamilo lms
Chamilo LMS Ticket TicketManager.php addProject cross site scripting
CVE-2026-112031
5.1 Medium
-
designthemes lms
WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-78532
7.1 High
-
forma lms
Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection
CVE-2026-96777
5.3 Medium
-
frappe lms
Frappe LMS: Path Traversal in SCORM File Serving
CVE-2026-54343
8.7 High
-
frappe lms
Frappe LMS enrollment bypass in paid courses via unrelated batch
CVE-2026-39385
7.1 High
-
designthemes lms
WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2026-27404
7.1 High
-
frappe lms
Reflected XSS in LMS
CVE-2026-40457
2.1 Low
-
frappe lms
OS Command Injection in LMS
CVE-2026-40456
8.6 High
-
frappe lms
SQL Injection in LMS
CVE-2026-40455
8.6 High
-
frappe learning, lms +1 more
Frappe LMS: HTML injection in user-controlled metadata
CVE-2026-46546
2.1 Low
-
epoupon lms
Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags
CVE-2026-48559
5.1 Medium
-
frappe lms
Frappe has Path Transversal via SCORM
CVE-2026-39405
9.4 Critical
-
frappe learning, lms +1 more
Frappe Learning Management System has Client-Side Manipulation of Quiz Scores
CVE-2026-39415
5.3 Medium
-
frappe learning, lms +1 more
Stored XSS in Frappe LMS
CVE-2026-34606
6.9 Medium
-
frappe learning, lms +1 more
Frappe Learning Management System exposes details of unpublished courses to unauthorized users
CVE-2026-26977
6.9 Medium
-
frappe learning, lms +1 more
Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students
CVE-2026-26031
1.3 Low
-
chamilo lms
Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization
CVE-2026-1106
5.3 Medium
-
frappe learning, lms +1 more
Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages
CVE-2026-23497
1.3 Low
-
frappe learning, lms +1 more
Frappe Authenticated Users can Execute JavaScript through its Job Form
CVE-2025-67734
5.1 Medium
-
frappe learning, lms +1 more
Frappe authenticated users can execute XSS through form description fields
CVE-2025-67730
Public exploit
5.1 Medium
-
frappe learning, lms +1 more
Frappe LMS is Missing Server-Side Authorization in Business Logic
CVE-2025-66581
1.3 Low
-
frappe learning, lms +1 more
Frappe LMS revoking access did not show immediate effect as roles were cached
CVE-2025-64707
1.2 Low
-
frappe learning, lms +1 more
Frappe user was able to access the submission of other students
CVE-2025-64705
1.3 Low
-
frappe learning, lms +1 more
Frappe Learning users were able to add HTML through input fields in the Job Form
CVE-2025-62779
1.2 Low
-
frappe learning, lms +1 more
Frappe Learning allowed students to access the Quiz Form via direct URL
CVE-2025-62778
1.3 Low
-
frappe learning, lms +1 more
Frappe had attachments made by students to their assignments of type Text set to public
CVE-2025-62158
2.7 Low
-
frappe lms, learning +1 more
Frappe LMS Course cross site scripting
CVE-2025-11283
4.8 Medium
-
frappe lms, learning +1 more
Frappe LMS Unpublished Course courses access control
CVE-2025-11281
2.3 Low
-
frappe lms, learning +1 more
Frappe LMS Assignment Picture files direct request
CVE-2025-11280
6.3 Medium
-
frappe learning, lms +1 more
Frappe Learning vulnerable to Malicious Content upload via Profile bio field
CVE-2025-59415
4.6 Medium
-
frappe lms, learning +1 more
Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting
CVE-2025-11282
4.8 Medium
-
frappe learning, lms +1 more
Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
CVE-2025-55006
4.3 Medium
-
designthemes lms
WordPress LMS theme <= 9.2 - SQL Injection Vulnerability
CVE-2025-52833
9.3 Critical
-
designthemes lms
WordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability
CVE-2025-52799
7.1 High
-
frappe lms
VIWIS LMS File Upload cross site scripting
CVE-2024-8002
6.9 Medium
-
frappe lms, viwis learning management system +1 more
VIWIS LMS Print authorization
CVE-2024-8001
6.9 Medium
-
frappe lms, totara enterprise lms +1 more
Totara LMS User Selector cross-site request forgery
CVE-2024-3932
2.3 Low
-
frappe lms, totara, totara enterprise lms +2 more
Totara LMS User Selector check.php cross site scripting
CVE-2024-3931
5.1 Medium
-
frappe lms, moodle +1 more
Inadequate access control vulnerability in Moodle
CVE-2024-1439
Fix available
6.5 Medium
-
frappe frappe/lms, learning +1 more
Cross-site Scripting (XSS) - Generic in frappe/lms
CVE-2023-5555
7.1 High
-
frappe learning, lms +1 more
Frappe LMS SQL Injection Issue on People Page
CVE-2023-42807
6.3 Medium
-
academy lms, creativeitem academy lms +1 more
Academy LMS GET Parameter filter sql injection
CVE-2023-4974
6.3 Medium
-
academy lms, creativeitem academy lms +1 more
Academy LMS GET Parameter filter cross site scripting
CVE-2023-4973
3.5 Low
-
academy lms, creativeitem academy lms +1 more
Academy LMS courses cross site scripting
CVE-2023-4119
Public exploit
4.3 Medium
-
fernus informatics lms, fernus learning management systems +1 more
Unrestricted Upload of File with Dangerous Type in Fernus LMS
CVE-2023-1728
9.8 Critical