CVE-2025-67734: Frappe Authenticated Users can Execute JavaScript through its Job Form

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 6% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

LM

lms · frappe

< 2.42.0 · source: vendor

LE

Learning · Frappe

2.0.0 before 2.42.0 · source: NVD