Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: LMS Clear all filters
TI-2026-29209 CVE-2026-40457 · GHSA-3vrh-xvg4-68rm

Reflected XSS in LMS

Priority LOW 11

A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the "dbrecover.php" and "netremap.php" modules where unsanitized GET parameters are directly embedded in…

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00318 Published 2026-06-18 Fixed CWE-79
TI-2026-29208 CVE-2026-40456 · GHSA-765c-7qf8-cw9w

OS Command Injection in LMS

Priority MEDIUM 41

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to exec…

CVSS 4.0HIGH 8.6 Adjacent network Low privileges No interaction EPSS 0.00947 Published 2026-06-18 Fixed CWE-78
TI-2026-29207 CVE-2026-40455 · GHSA-qrw9-xj5g-qxw8

SQL Injection in LMS

Priority LOW 39

An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization of the POST "tg[]" parameter.

CVSS 4.0HIGH 8.6 Adjacent network Low privileges No interaction EPSS 0.00216 Published 2026-06-18 Fixed CWE-89