CVE-2025-11280 - CVE House
Back to Database
Status published Medium CVE-2025-11280

Frappe LMS Assignment Picture files direct request

Vulnerability Description

A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation causes direct request. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-11280

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • 0xHamy (VulDB User)

References

More from Frappe

View All →
CVE-2025-11461
Frappe CRM 1.53.1 — Multiple SQL Injections in Dashboard Controller
High 7.1
CVE-2025-11283
Frappe LMS Course cross site scripting
Medium 4.8
CVE-2025-11282
Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting
Medium 4.8
CVE-2025-11281
Frappe LMS Unpublished Course courses access control
Low 2.3
CVE-2025-10655
Frappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_data
High 8.6

Affected Vendor

Affected Software

LMS
Vulnerable Versions:
2.35.0

Timeline

Official Publish: October 5th, 2025
Last Modified: October 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

Weaknesses (CWE)

CWE-425

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.