Vulnerability · Published Jun 18, 2026 · Assigned by CERT-PL

CVE-2026-40457Reflected XSS in LMS

Low 2.1

In plain English

A low-severity cross-site scripting in LMS from LMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.3%top 75.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the "dbrecover.php" and "netremap.php" modules where unsanitized GET parameters are directly embedded into HTML output. This allows an attacker to inject arbitrary JavaScript when an authenticated user clicks a crafted link, provided the required conditions (such as a network defined in the system) are met.

Affected products (as reported)

Vendor	Product	Versions
LMS	LMS	0 – before 9c5651b

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/chilek/lms/commit/9c5651b39bfd086cc34fc9a78ddaa8c0815af114 patch
https://cert.pl/posts/2026/06/CVE-2026-40455 third-party-advisory
https://lms.org.pl/ product