CVE-2026-34606

low-risk

Published 2026-04-02

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.

Do I need to act?

0.03% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Learning

Affected Vendors

Frappe

References (4)

Patch https://github.com/frappe/lms/commit/b8283860a7f029ea2fa0245131c398c079088921

Issue Tracking https://github.com/frappe/lms/pull/2185

Product https://github.com/frappe/lms/releases/tag/v2.48.0

Vendor Advisory https://github.com/frappe/lms/security/advisories/GHSA-qf5w-r34q-c7j2

/ 100

low-risk

Severity 23/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal