Frappe LMS has Stored XSS in Course Meta

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…pe/lms/security/advisories/GHSA-9fqj-95wr-6hm6 Diğer
• github.com/…ommit/cd6aca25f7d28425660720db4fdb920727edb670 Diğer
• github.com/…ommit/f244a6c9ff6e0b104fec48b2d97af4cc09896b60 Diğer
• github.com/frappe/lms/tree/v2.52.0 Diğer

Kayıt geçmişi

1. 30 Eki 2026 19:46Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-61806Frappe LMS allows unpublished certificate access
• 5,3 CVE-2026-61805Frappe LMS: Quiz result manipulation and cross-user submission forgery
• 5,3 CVE-2026-61803Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
• 6,5 CVE-2026-39739WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability
• 6,8 CVE-2026-119764Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview
• 6,1 CVE-2026-119761Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name