Vulnerabilidades do LMS LMS
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam LMS LMS: 3 registro(s), com versões afetadas e correções.
CVE-2026-40457
Baixa · 2.1
CWE-79 18/06/2026
Reflected XSS in LMS
A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the "dbrecover.php" and "netremap.php" modules where unsanitized GET parameters are directly embedded into HTML output. This allows an attacker to inject arbitrary JavaScript when an authenticated user clicks a crafted link, provided the required conditions (such as a network defined in the system) are met.
CVE-2026-40456
Alta · 8.6
CWE-78 18/06/2026
OS Command Injection in LMS
An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.
CVE-2026-40455
Alta · 8.6
CWE-89 18/06/2026
SQL Injection in LMS
An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization of the POST "tg[]" parameter. The application directly concatenates user-supplied array values into an SQL query using "implode()", allowing authenticated attackers to perform Error-Based SQL injection and extract sensitive database information.