lms
- Software type
- Education software
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, lms recorded 5 security vulnerabilities in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of lms and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-61806Frappe LMS allows unpublished certificate accessCVE-2026-61805Frappe LMS: Quiz result manipulation and cross-user submission forgeryCVE-2026-61803Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amountCVE-2026-39375Frappe LMS has Stored XSS in Course MetaCVE-2026-54343Frappe LMS: Path Traversal in SCORM File Serving| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-61806Frappe LMS allows unpublished certificate access | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-61805Frappe LMS: Quiz result manipulation and cross-user submission forgery | Exploitation statusNot exploited | FixYes | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-61803Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount | Exploitation statusNot exploited | FixYes | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-39375Frappe LMS has Stored XSS in Course Meta | Exploitation statusNot exploited | FixYes | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-54343Frappe LMS: Path Traversal in SCORM File Serving | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-39385Frappe LMS enrollment bypass in paid courses via unrelated batch | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityHigh |
|---|
CVE-2026-46546Frappe LMS: HTML injection in user-controlled metadata | Exploitation statusNot exploited | FixYes | Published06/09/2026 | SeverityLow |
|---|
CVE-2026-39405Path traversal in SCORM package uploads affects Frappe Learning Management System (LMS) | Exploitation statusNot exploited | FixYes | Published05/20/2026 | SeverityCritical |
|---|
CVE-2026-39415Frappe Learning Management System has Client-Side Manipulation of Quiz Scores | Exploitation statusNot exploited | FixYes | Published04/08/2026 | SeverityMedium |
|---|
CVE-2026-34606Stored XSS in Frappe LMS | Exploitation statusNot exploited | FixYes | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-26977Frappe Learning Management System exposes details of unpublished courses to unauthorized users | Exploitation statusNot exploited | FixNo | Published02/20/2026 | SeverityMedium |
|---|
CVE-2026-26031Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students | Exploitation statusNot exploited | FixYes | Published02/11/2026 | SeverityLow |
|---|
CVE-2026-23497Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages | Exploitation statusNot exploited | FixNo | Published01/14/2026 | SeverityLow |
|---|
CVE-2025-67734Frappe Authenticated Users can Execute JavaScript through its Job Form | Exploitation statusNot exploited | FixYes | Published12/12/2025 | SeverityMedium |
|---|
CVE-2025-67730Frappe authenticated users can execute XSS through form description fields | Exploitation statusNot exploited | FixYes | Published12/12/2025 | SeverityMedium |
|---|
CVE-2025-66581Frappe LMS is Missing Server-Side Authorization in Business Logic | Exploitation statusNot exploited | FixYes | Published12/05/2025 | SeverityLow |
|---|
CVE-2025-64707Frappe LMS revoking access did not show immediate effect as roles were cached | Exploitation statusNot exploited | FixYes | Published11/12/2025 | SeverityLow |
|---|
CVE-2025-64705Frappe user was able to access the submission of other students | Exploitation statusNot exploited | FixYes | Published11/12/2025 | SeverityLow |
|---|
CVE-2025-62779Frappe Learning users were able to add HTML through input fields in the Job Form | Exploitation statusNot exploited | FixNo | Published10/27/2025 | SeverityLow |
|---|
CVE-2025-62778Frappe Learning allowed students to access the Quiz Form via direct URL | Exploitation statusNot exploited | FixNo | Published10/27/2025 | SeverityLow |
|---|
CVE-2025-62158Frappe had attachments made by students to their assignments of type Text set to public | Exploitation statusNot exploited | FixYes | Published10/10/2025 | SeverityLow |
|---|
CVE-2025-11283Frappe LMS Course cross site scripting | Exploitation statusActively exploited | FixNo | Published10/05/2025 | SeverityMedium |
|---|
CVE-2025-11282Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting | Exploitation statusActively exploited | FixNo | Published10/05/2025 | SeverityMedium |
|---|
CVE-2025-11281Frappe LMS Unpublished Course courses access control | Exploitation statusActively exploited | FixNo | Published10/05/2025 | SeverityLow |
|---|
CVE-2025-11280Frappe LMS Assignment Picture files direct request | Exploitation statusActively exploited | FixNo | Published10/05/2025 | SeverityMedium |
|---|
CVE-2025-59415Frappe Learning vulnerable to Malicious Content upload via Profile bio field | Exploitation statusNot exploited | FixNo | Published09/17/2025 | SeverityMedium |
|---|
CVE-2025-55006Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature | Exploitation statusNot exploited | FixNo | Published08/09/2025 | SeverityMedium |
|---|
CVE-2023-42807Frappe LMS SQL Injection Issue on People Page | Exploitation statusNot exploited | FixYes | Published09/21/2023 | SeverityMedium |
|---|
28 Results | Page 1 of 1