CVE-2025-11282

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-11282

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11282.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-11282

Aliases

CVE-2025-55006
GHSA-mvxw-r9x4-3vrr

Published

2025-10-05T04:32:06.034Z

Modified

2026-07-15T01:49:09.659618732Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting

Details

A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.

Database specific

{
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11282.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/frappe/lms

Affected ranges

Type

GIT

Repo

https://github.com/frappe/lms

Events

Introduced

5ff100da27ef81ee093a79287f75bffb6a1c9197

Last affected

2e0cd1964c4a4dd2e5a45a6ce946c89194635894

Database specific

{
    "cpe": "cpe:2.3:a:frappe:learning:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.34.*"
        },
        {
            "last_affected": "2.34.*"
        },
        {
            "introduced": "2.35.0"
        },
        {
            "last_affected": "2.35.0"
        },
        {
            "introduced": "2.34.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

2.*

2.34.*

2.35.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11282.json"