Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-62779: Frappe Learning job form accepts raw HTML

CVE-2025-62779 · published 1 year ago

Summary

In Frappe Learning version 2.39.1 and earlier, the Job Form allowed users to insert raw HTML code. This can let someone add unwanted or malicious content that could affect how pages display for other users. Upgrade to a newer release or apply a patch that removes HTML input from the form.

What to do

Update frappe learning to version 2.39.2 or later.

Affected software

Vendor	Product	Affected versions
frappe	learning	>= 2.0.0, < 2.39.2 `cpe:2.3:a:frappe:learning::::::::`

Original advisory text

Frappe Learning users were able to add HTML through input fields in the Job Form

Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input fields in the Job Form.

References

https://github.com/frappe/lms/security/advisories/GHSA-j6h8-qg65-3fpx Vendor Advisory
https://github.com/frappe/lms/commit/75001b494d5d8198eab20b0cd85d5bd719448ea3 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62779... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-62779 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.0 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published27 Oct 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-62779 · NVD

CVE-2025-62779 · OSV

GHSA-j6h8-qg65-3fpx · GHSA

Track software like this

Free during beta