The vulnerability in Frappe Learning Management System allows students to alter quiz scores before submission by modifying client-side calculations. This compromise affects the integrity of quiz results, but it does not expose confidential data, provide privilege escalation, or grant access to other users' accounts.

The issue affects installations of Frappe Learning Management System before version 2.46.0. Users running any earlier release are susceptible to manipulating quiz scores through browser developer tools.

With a CVSS score of 5.3 and an EPSS score below 1 %, the risk is moderate and the likelihood of exploitation is low. The attack vector is local, requiring the victim to use browser tools to alter the score value before sending the submission. Because it is client‑side, no network compromise is necessary. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation in the wild.