CyberSecBulletin

LMS vulnerabilities

We track 2 vulnerabilities in LMS products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on June 18, 2026.

2vulnerabilities
0critical
2high
0exploited
8.6average CVSS score

Latest LMS vulnerabilities

  • 8.6 High severity

    LMS: Improper Neutralization of Special Elements used in an OS Command

    CVE-2026-40456LMS

    An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.

  • 8.6 High severity

    LMS: Improper Neutralization of Special Elements used in an SQL Command

    CVE-2026-40455LMS

    An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization of the POST "tg[]" parameter. The application directly concatenates user-supplied array values into a