PT-2026-29861 · Frappe · Lms

Raizasafeel · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-34606

Mitre

CVSS v4.0

6.9

Medium

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34606

Affected Products

Lms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34606 · Security Note
• https://github.com/frappe/lms/pull/2185 · Note
• https://github.com/frappe/lms/security/advisories/GHSA-qf5w-r34q-c7j2 · Note
• https://github.com/frappe/lms/commit/b8283860a7f029ea2fa0245131c398c079088921 · Note
• https://github.com/frappe/lms/releases/tag/v2.48.0 · Note