CVE-2025-67734— Frappe Authenticated Users can Execute JavaScript through its Job Form

Frappe Authenticated Users can Execute JavaScript through its Job Form

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Frappe Learning Management System 跨站脚本漏洞

Frappe Learning Management System是Frappe开源的一个易于使用的开源学习管理系统。 Frappe Learning Management System 2.42.0之前版本存在跨站脚本漏洞，该漏洞源于Job Form中Company Website字段可注入JavaScript，可能导致跨站脚本攻击。

N/A

N/A