{"cve":"CVE-2023-42807","nvd":{"published":"2023-09-21T17:15:23.950","modified":"2026-06-17T06:24:33.420","status":"Modified","description":"Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-89"],"references":["https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63","https://github.com/frappe/lms/security/advisories/GHSA-wvq3-3wvp-6x63"],"products":["frappe:learning"],"source":"nvd","synced_at":"2026-10-19T21:39:24.235896374+00:00"},"epss":{"cve":"CVE-2023-42807","score":0.00399,"percentile":0.34156,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}