Frappe LMS: HTML injection in user-controlled metadata (CVE-2026-46546) | HOL Guard CVE