A flaw in the client‑side score calculation allows a user to alter the displayed score with browser developer tools before the quiz result is submitted. The altered score is accepted by the server, so the final record for that quiz contains the malicious value. The vulnerability does not permit access to other users’ data or raise privileges; it only undermines the accuracy of a single student’s results and weakens the overall academic reliability of the system.

The vulnerability affects Frappe Learning Management System versions earlier than 2.46.0. Users running the cataloged LMS without an upgrade to the patched release are susceptible. No other vendors or products are affected.

The CVSS score of 5.3 denotes moderate overall risk. Exploitation requires only the ability to open a quiz page in a browser. An attacker can alter the score locally with minimal effort, so the likelihood of abuse among active users is high, though it does not grant any additional access or compromise confidential data. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available, indicating limited public exploitation data but a realistic threat in environments where academic integrity matters.