PT-2026-50664 · Lms · Lms

Tymoteusz Dominik · Publicado 2026-06-18 · Atualizado 2026-06-18 · CVE-2026-40456

NVD

CVSS v4.0

8.6

Alta

Vetor base

AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-40456

Produtos afetados

Lms

Referências · 4

• https://github.com/chilek/lms/commit/9fcb4de19b7d76394898dbc124252b86b07ac0ed · Correção
• https://lms.org.pl · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-40456 · Nota de Segurança
• https://cert.pl/posts/2026/06/CVE-2026-40455 · Nota