Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-67730 — A public disclourse of CVE-2025-67730 in Frape lms By dharan ragunathan | Kitploit
Tools/GitHubGitHub/dharan10/cve-2025-67730
Vulnerability AnalysisWeb Application ExploitationWeb SecurityPapers & ResearchLearning & Education
GitHubdharan10/cve-2025-67730

CVE-2025-67730

A public disclourse of CVE-2025-67730 in Frape lms By dharan ragunathan

View Repository
28 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-67730 – Stored Cross-Site Scripting (XSS)

Overview

CVE ID: CVE-2025-67730 Vulnerability Type: Stored Cross-Site Scripting (XSS) Severity: Medium–High (context-dependent)

This vulnerability allowed authenticated users to inject malicious HTML and JavaScript into description fields of Job, Course, and Batch forms. The injected payload would execute automatically in the browser of any user who later viewed the affected Job, Course, or Batch.

Affected Components

  • Job description field
  • Course description field
  • Batch description field

Impact

  • Execution of arbitrary JavaScript in victim browsers
  • Session hijacking
  • Credential theft
  • Account takeover (depending on privilege level)
  • DOM manipulation and phishing

Because the payload is stored, the attack persists and affects every user who views the compromised content.

Attack Scenario

  1. Attacker logs in with a valid user account.
  2. Attacker creates or edits a Job, Course, or Batch.
  3. Malicious JavaScript is inserted into the description field.
  • The payload is saved in the database.
  • Any user opening the affected page triggers the payload.

    • Proof of Concept (PoC)

    root@kitploit:~
    ">

    Steps to Reproduce:

    1. Log in as any authenticated user.
    2. Navigate to Job / Course / Batch creation or edit page.
    3. Paste the payload into the description field.
    4. Save the form.
    5. Open the created Job / Course / Batch.
    6. JavaScript executes in the browser.

    Root Cause

    • Missing or insufficient server-side HTML sanitization
    • Unsafe rendering of user-supplied input
    • Lack of output encoding in templates

    Fix / Mitigation

    Official Patch

    • Fixed in version: 2.42.0

    Security Improvements Implemented

    • Proper HTML sanitization on input
    • Safe output encoding before rendering
    • Restriction of executable tags and attributes

    Recommended Best Practices

    • Always sanitize user input on the server side
    • Apply output encoding based on context (HTML, JS, URL)
    • Use a trusted HTML sanitizer (e.g., DOMPurify)
    • Implement Content Security Policy (CSP)

    Timeline

    • Reported by: Dharan Raghunathan
    • Status: Fixed
    • Patch Release: Version 2.42.0

    Acknowledgement

    This issue was responsibly disclosed by Dharan Raghunathan.

    References

    • OWASP Stored XSS: https://owasp.org/www-community/attacks/xss/
    • CWE-79: Improper Neutralization of Input During Web Page Generation
    • Github Advisory: https://github.com/frappe/lms/security/advisories/GHSA-jjc4-j3hw-33h2

    Disclaimer

    This document is for educational and defensive security purposes only.

    Download Tool