CVE-2026-40455

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40455
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40455.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40455
Published
2026-06-18T10:58:50Z
Modified
2026-10-28T02:30:40Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
SQL Injection in LMS
Details

An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization of the POST "tg[]" parameter. The application directly concatenates user-supplied array values into an SQL query using "implode()", allowing authenticated attackers to perform Error-Based SQL injection and extract sensitive database information.

Database specific 
{
    "cna_assigner":  "CERT-PL",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40455.json"
}
References

Affected packages

Git / github.com/chilek/lms

Affected ranges

Type
GIT
Repo
https://github.com/chilek/lms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4cb30a7
Fixed
4cb30a70e7e3d8a0ea53afa2dbef19d5243d449b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "4cb30a7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "4cb30a70e7e3d8a0ea53afa2dbef19d5243d449b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
LMS_010000_rc1
LMS_0100_pre1
LMS_0100_pre10
LMS_0100_pre2
LMS_0100_pre3
LMS_0100_pre4
LMS_0100_pre5
LMS_0100_pre6
LMS_0100_pre7
LMS_0100_pre8
LMS_0100_pre9
LMS_010100
LMS_010101
LMS_010102
LMS_010103
LMS_010104
LMS_010105
LMS_010107
LMS_010302
LMS_010501
LMS_010502
LMS_010503
LMS_010504
LMS_010505
LMS_010506
LMS_010700
LMS_010701
LMS_010703
LMS_010900
LMS_010907
LMS_011102
LMS_011103
LMS_011104
LMS_011105
LMS_011106
LMS_011107
LMS_011108
LMS_011109
LMS_011114
LMS_011115
LMS_011116
LMS_011117
LMS_011118
LMS_011119
LMS_011121
LMS_011122
LMS_011123
LMS_24
LMS_25
LMS_27
NO_LANGUAGE_SUPPORT
OLD_FINANCES
X_Apophis
X_Aris
X_Belos
X_Bray
X_Cronos
X_Dira
X_Doci
X_Grannus
X_Idos
X_Ju
X_Jumar
X_Kinsey
X_Kri
X_Marduk
X_Maybourne
X_Mot
X_Osiris
X_Seth
X_Shaq'Ran
X_Sokar
X_Tagar
X_Talus
X_Terok
X_Thanos
X_Thoth
X_Wraith
X_Zarin
hunter-devel
multilanguage

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40455.json"