CVE-2023-42807

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
frappe	lms	<= 1.0

References

https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63Third Party Advisory
https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63Third Party Advisory

Timeline

Published: Sep 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-428086.1Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets f CVE-2023-428098.8Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server CVE-2023-42815.3This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to ma CVE-2023-428109.8systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. Th CVE-2023-428115.5aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation CVE-2023-428124.3Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which CVE-2023-428135.3Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of se CVE-2023-428145.3Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of se CVE-2023-428155.3Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of se CVE-2023-428165.3Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of se CVE-2023-428175.4Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parse CVE-2023-428189.8JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verif