PT-2025-38279 · Unknown · Frappe Learning

Sudip Roy + 1 · Publicado 2025-09-17 · Atualizado 2025-09-18 · CVE-2025-59415

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe Learning versions 2.34.1 and below

Description Frappe Learning does not adequately sanitize content uploaded in the profile bio. This allows for the execution of arbitrary scripts in the context of other users through malicious SVG files.

Recommendations Versions prior to 2.34.1 should be updated.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-59415

GHSA-H7GH-3VQ5-96JX

Produtos afetados

Frappe Learning

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59415.json · Exploit
• https://github.com/frappe/lms/commit/ed162e254690772365d4d1365f176b59bc4db72d · Correção
• https://github.com/frappe/lms/security/advisories/GHSA-h7gh-3vq5-96jx · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1968561167833481342 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-59415 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-59415 · Nota de Segurança