CVE-2026-39415— Frappe Learning Management System has Client-Side Manipulation of Quiz Scores
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-39415
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe Learning Management System has Client-Side Manipulation of Quiz Scores
Source: NVD (National Vulnerability Database)
Vulnerability Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated scores, which can be altered using browser developer tools prior to sending the submission request. While this does not allow modification of other users’ data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability. This issue affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. This vulnerability is fixed in 2.46.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端安全的客户端实施
Source: NVD (National Vulnerability Database)
Vulnerability Title
Frappe Learning Management System 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Frappe Learning Management System是Frappe开源的一个易于使用的开源学习管理系统。 Frappe Learning Management System 2.46.0之前版本存在安全漏洞，该漏洞源于依赖客户端计算的测验分数，可能导致学生在提交前修改分数，损害测验结果的完整性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-39415
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39415
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: lms
- CVE-2026-34606
Stored XSS in Frappe LMS - CVE-2026-26977
Frappe Learning Management System exposes details of unpubli - CVE-2026-26031
Frappe LMS affected by unauthorised user was able to access - CVE-2026-1106
Chamilo LMS Legal Consent SocialController.php deleteLegal i - CVE-2026-23497
Frappe LMS has a Stored XSS via Unsanitized Image Filename i
Same vendor: frappe
- CVE-2026-41430
Press vulnerable to reflected XSS on login redirection - CVE-2026-41317
Frappe Press has an unsafe HTTP method / CSRF-adjacent issue - CVE-2026-3837
Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field - CVE-2026-3673
Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Render - CVE-2026-41320
Frappe HR has possibility of SQL Injection due to improper f
Same weakness: CWE-602
- CVE-2026-42160
Data Space Portal: Incorrect Authorization and Client-Side E - CVE-2026-25737
Budibase Arbitrary File Upload Leading to Multiple Critical - CVE-2026-30783
RustDesk Client Can Orphan API Channel to Ignore All Admin C - CVE-2026-23859
Dell Wyse Management Suite WMS 安全漏洞 - CVE-2025-36410
Multiple vulnerabilities found in IBM ApplinX.
V. Comments for CVE-2026-39415
No comments yet