CVE-2023-42807

MEDIUM

6.3

Description

Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.

CVE Details

CVSS v3.1 Score6.3

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published9/21/2023

Last Modified10/3/2025

Sourcenvd

Honeypot Sightings0

Affected Products

frappe:learning

Weaknesses (CWE)

CWE-89

References

https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63(security-advisories@github.com)

https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.