CVE-2026-40456highCWE-78

CVE-2026-40456: high-severity vulnerability in LMS

OS Command Injection in LMS

Published

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 2.8%
exploitation probability
2.8%top 14% of all CVEs
observed exploitation
nono source reports it
An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
Affected products
LMS · LMS
Related CVEs — LMS

In the same product, most dangerous first.

CVE-2026-40457LOWReflected XSS in LMSEPSS 0.5%CVE-2026-40455HIGHSQL Injection in LMSEPSS 0.3%
References
https://cert.pl/posts/2026/06/CVE-2026-40455https://github.com/chilek/lms/commit/9fcb4de19b7d76394898dbc124252b86b07ac0edhttps://lms.org.pl/