Vulnerability · Published Jun 18, 2026 · Assigned by CERT-PL

CVE-2026-40455SQL Injection in LMS

High 8.6

In plain English

A high-severity SQL injection in LMS from LMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.2%top 87.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization of the POST "tg[]" parameter. The application directly concatenates user-supplied array values into an SQL query using "implode()", allowing authenticated attackers to perform Error-Based SQL injection and extract sensitive database information.

Affected products (as reported)

Vendor	Product	Versions
LMS	LMS	0 – before 4cb30a7

Weakness: CWE-89 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/chilek/lms/commit/4cb30a70e7e3d8a0ea53afa2dbef19d5243d449b patch
https://cert.pl/posts/2026/06/CVE-2026-40455 third-party-advisory
https://lms.org.pl/ product