Medium severity · published Dec 12, 2025
CVE-2025-67730
Frappe authenticated users can execute XSS through form description fields
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
lms · frappe
< 2.42.0 · source: vendor
LE
Learning · Frappe
2.0.0 before 2.42.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67730
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67730
Patch
https://github.com/frappe/lms/commit/0877e32e1bfe64831b875707241de1c449cda45c
Vendor Advisory
https://github.com/frappe/lms/security/advisories/GHSA-jjc4-j3hw-33h2
More from lms
9.4
CVE-2026-39405
Frappe has Path Transversal via SCORM
8.8
CVE-2025-55006
Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
8.7
CVE-2026-54343
Frappe LMS: Path Traversal in SCORM File Serving
7.1
CVE-2026-39385
Frappe LMS enrollment bypass in paid courses via unrelated batch
6.5
CVE-2025-66581
Frappe LMS is Missing Server-Side Authorization in Business Logic