VulnerabilityAnalyzed

CVE-2025-67734

Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack.

MEDIUM 5.1EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.17% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: frappe/learning
Source: security-advisories@github.com

References

https://github.com/frappe/lms/commit/ca849da81558066d7614b9b6234004ff59c90632Patch
https://github.com/frappe/lms/security/advisories/GHSA-c495-qg4v-5vr7Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.