CVE-2026-23497

Katalog CVE

CVSS 5.4 · Medium EPSS 0,17%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada frappe learning. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript when rendered on course or jobs pages.

Rincian

Terbit di NVD

14 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/frappe/lms/commit/e7ccf0a711d0e0ab5e6b28b7a1e4e0510b6b9543 patch
• https://github.com/frappe/lms/security/advisories/GHSA-78mq-3whw-69j5 advisory pihak ketiga