Frappe authenticated users can execute XSS through form description fields

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Frappe Learning Management System 跨站脚本漏洞

Frappe Learning Management System是Frappe开源的一个易于使用的开源学习管理系统。 Frappe Learning Management System 2.42.0之前版本存在跨站脚本漏洞，该漏洞源于Job、Course和Batch表单描述字段可注入恶意HTML和JavaScript。

N/A

N/A