PT-2023-28593 · Unknown · Frappe Lms

Muztahidul Islam Tanim · Publicado 2023-09-21 · Atualizado 2025-10-03 · CVE-2023-42807

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Frappe LMS versions 1.0.0 and prior

Description Frappe LMS is an open source learning management system. The issue is related to an SQL Injection vulnerability on the People Page of LMS. The vulnerability has been fixed in the main branch.

Recommendations For versions 1.0.0 and prior, update to the latest main branch to resolve the issue. As a temporary workaround, consider restricting access to the People Page of LMS until the update is applied.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-42807

GHSA-WVQ3-3WVP-6X63

Produtos afetados

Frappe Lms

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42807.json · Exploit
• https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63 · Nota
• https://osv.dev/vulnerability/CVE-2023-42807 · Aviso do Fabricante
• https://t.me/cveNotify/137339 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-42807 · Nota de Segurança
• https://t.me/cibsecurity/70911 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1704931259183489526 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1704901540656329149 · Publicação no Twitter