Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-34606 EUVD-2026-18462

Stored XSS in Frappe LMS

Published Apr 2, 2026 · Updated Apr 3, 2026 · Assigned by GitHub_M

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.

Affected products

VendorProductAffectedFixed
frappe lms >= 2.27.0, < 2.48.0 —

References