Lms

This hub aggregates every CVE we track for Lms, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Lms.

• CVE-2026-27404WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1Jul 2, 2026
• CVE-2026-46546Frappe LMS: HTML injection in user-controlled metadata5.4Jun 9, 2026
• CVE-2026-48559Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags5.4Jun 1, 2026
• CVE-2026-39415Frappe Learning Management System has Client-Side Manipulation of Quiz Scores4.3Apr 8, 2026
• CVE-2026-34606Stored XSS in Frappe LMS6.1Apr 2, 2026
• CVE-2026-26977Frappe Learning Management System exposes details of unpublished courses to unauthorized users5.3Feb 20, 2026
• CVE-2026-26031Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students5.3Feb 11, 2026
• CVE-2026-1106Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization5.4Jan 18, 2026
• CVE-2026-23497Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages5.4Jan 14, 2026
• CVE-2025-67734Frappe Authenticated Users can Execute JavaScript through its Job Form5.4Dec 12, 2025
• CVE-2025-67730Frappe authenticated users can execute XSS through form description fields5.4Dec 12, 2025
• CVE-2025-66581Frappe LMS is Missing Server-Side Authorization in Business Logic6.5Dec 5, 2025
• CVE-2025-64707Frappe LMS revoking access did not show immediate effect as roles were cached5.4Nov 12, 2025
• CVE-2025-64705Frappe user was able to access the submission of other students4.3Nov 12, 2025
• CVE-2025-62779Frappe Learning users were able to add HTML through input fields in the Job Form5.4Oct 27, 2025