{"id":"CVE-2025-59415","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-59415","generatedAt":"2026-10-28T01:48:06.995Z","title":"In versions 2.34.1 and below, there is a security vulnerability in Frappe Learning where the system did not adequately sanitize the content uploaded in the profile bio.","description":"Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learning where the system did not adequately sanitize the content uploaded in the profile bio. Malicious SVG files could be used to execute arbitrary scripts in the context of other users.","published":"2025-09-17T21:15:38.000Z","lastModified":"2026-06-17T09:46:08.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["frappe/learning"],"epss":{"score":0.0025,"percentile":0.16179,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/frappe/lms/commit/ed162e254690772365d4d1365f176b59bc4db72d","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/frappe/lms/security/advisories/GHSA-h7gh-3vq5-96jx","tags":["Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-59415","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}