XSS in Frappe Lms
CVE-2026-23497
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript w…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.001 (16.7th percentile) — read the EPSS interpretation.
Affected products
- Frappe Lms — versions <= 2.44.0
Weakness classification (CWE)
References
- https://github.com/frappe/lms/security/advisories/GHSA-78mq-3whw-69j5 (x_refsource_CONFIRM)
- https://github.com/frappe/lms/commit/e7ccf0a711d0e0ab5e6b28b7a1e4e0510b6b9543 (x_refsource_MISC)