CVE-2026-40457

Reflected XSS in LMS

State: Published
Severity: 2.1 Low
Published: Jun 18, 2026
Updated: Jun 18, 2026
Reserved: Apr 13, 2026

Description

A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the "dbrecover.php" and "netremap.php" modules where unsanitized GET parameters are directly embedded into HTML output. This allows an attacker to inject arbitrary JavaScript when an authenticated user clicks a crafted link, provided the required conditions (such as a network defined in the system) are met.

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	CERT-PL

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
LMSLMS	before 9c5651bAffected

References

https://github.com/chilek/lms/commit/9c5651b39bfd086cc34fc9a78ddaa8c0815af114patch
https://cert.pl/posts/2026/06/CVE-2026-40455third-party-advisory
https://lms.org.pl/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.