Medium severity5.4NVD Advisory· Published Dec 12, 2025· Updated Jun 17, 2026

CVE-2025-67730

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Learning
cpe:2.3:a:frappe:learning:*:*:*:*:*:*:*:*
Range: >=2.0.0,<2.42.0
Frappe/Learning Management Systemllm-fuzzy
Range: <2.42.0
Frappe/Lmsllm-fuzzy2 versions
<2.42.0+ 1 more
- (no CPE)range: <2.42.0
- (no CPE)range: < 2.42.0

Patches

Vulnerability mechanics

References

github.com/frappe/lms/commit/0877e32e1bfe64831b875707241de1c449cda45cnvdPatch
github.com/frappe/lms/security/advisories/GHSA-jjc4-j3hw-33h2nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000