CVE-2025-67734: Frappe Authenticated Users can Execute JavaScript through its Job Form
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67734?
CVE-2025-67734 has a medium severity due to its potential for XSS attacks affecting users.
How do I fix CVE-2025-67734?
To fix CVE-2025-67734, upgrade the Frappe Learning Management System to version 2.42.0 or later.
Who is affected by CVE-2025-67734?
CVE-2025-67734 affects users of the Frappe Learning Management System versions prior to 2.42.0.
What type of vulnerability is CVE-2025-67734?
CVE-2025-67734 is a cross-site scripting (XSS) vulnerability.
Can CVE-2025-67734 be exploited remotely?
Yes, CVE-2025-67734 can be exploited remotely by authenticated attackers.