CVE-2025-64705 LOW

CVE-2025-64705: Frappe user was able to access the submission of other students

Vendor Frappe

Product lms

Weakness CWE-200 · Info exposure

Published November 12, 2025

Last update November 13, 2025

View on NVD All CVEs

CVSS base score

1.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access the submissions made by other students The issue has been fixed in version 2.41.0 by ensuring proper roles and redirecting if accessed via direct URL.

Key dates

02Disclosure timeline

November 12, 2025 CVE published

November 13, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-64705 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

04Related CVE

CVE-2021-20331 MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application CVE-2019-1734 Cisco FXOS and NX-OS Software Sensitive File Read Information Disclosure Vulnerability CVE-2026-47176 Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel CVE-2024-3870 Contact Form 7 Database Addon – CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure CVE-2024-1979 Quarkus: information leak in annotation