Is there a patch available for CVE-2026-40457?

Yes, a patch is available for CVE-2026-40457. Update the affected software to the latest version immediately.

LAN Management System CVE-2026-40457

Q: What is the CVSS score of CVE-2026-40457?

CVE-2026-40457 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37876 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-18 CERT-PL

GHSA-3vrh-xvg4-68rm

PHP XSS Lms

2.1

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Attacker requires no authentication (PR:N), but victim must actively click a crafted link (UI:R); JavaScript executes in victim's browser scope (S:C) with low C/I impact and no server-side availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 18, 2026 - 12:35 vuln.today

Analysis Generated

Jun 18, 2026 - 12:35 vuln.today

DescriptionCVE.org

A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the "dbrecover.php" and "netremap.php" modules where unsanitized GET parameters are directly embedded into HTML output. This allows an attacker to inject arbitrary JavaScript when an authenticated user clicks a crafted link, provided the required conditions (such as a network defined in the system) are met.

AnalysisAI

Reflected XSS in LAN Management System (LMS) before commit 9c5651b allows network-positioned attackers to inject arbitrary JavaScript into the browsers of authenticated LMS users by crafting malicious links targeting the dbrecover.php and netremap.php modules. The db, id, and mapto GET parameters were directly concatenated into HTML anchor elements without sanitization, as confirmed by the upstream commit diff. No public exploit has been identified at time of analysis, exploitation is not confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects genuinely constrained impact due to the required victim interaction and specific attack preconditions.

Technical ContextAI

LMS is a PHP-based LAN Management System primarily used by ISPs and network operators to manage network resources, IP assignments, and subscriber data. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): two PHP modules, dbrecover.php and netremap.php, directly interpolated unsanitized GET parameters into HTML <A href> anchor tags. Specifically, $_GET['db'] in dbrecover.php and $_GET['id']/$_GET['mapto'] in netremap.php were string-concatenated into the href attribute value with no escaping. The commit diff at 9c5651b confirms the fix: PHP's htmlspecialchars() was applied to each parameter, converting special characters to HTML entities and neutralizing injection. The CPE cpe:2.3:a:lms:lms:*:*:*:*:*:*:*:* with a wildcard version indicates the vulnerability spans the full version history prior to the patched commit.

RemediationAI

Apply the upstream fix by updating LMS to a build incorporating commit 9c5651b (https://github.com/chilek/lms/commit/9c5651b39bfd086cc34fc9a78ddaa8c0815af114), which adds htmlspecialchars() escaping to all affected GET parameters in both dbrecover.php and netremap.php. Because the fix is delivered as a commit rather than a tagged release, operators should verify via https://lms.org.pl/ or the project's release history whether a packaged release incorporating this commit has been published - the patch is upstream fix available (commit); a released patched version is not independently confirmed from available data. If immediate patching is not possible, restrict HTTP access to the dbrecover.php and netremap.php modules via web server ACLs or firewall rules limiting requests to trusted administrator IP ranges only; this eliminates the social-engineering attack vector but removes remote admin access to these modules. Refer to the CERT-PL advisory at https://cert.pl/posts/2026/06/CVE-2026-40455 for any additional vendor-specific remediation guidance.