What is GHSA-3vrh-xvg4-68rm?

GHSA-3vrh-xvg4-68rm is a security advisory published by GitHub Security Advisories with Low severity. A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before...

Which CVE IDs does GHSA-3vrh-xvg4-68rm cover?

GHSA-3vrh-xvg4-68rm covers the following CVE IDs: CVE-2026-40457. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-3vrh-xvg4-68rmLow

A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before...

Vendor

GitHub Security Advisories

Published

June 18, 2026

Last Modified

June 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-40457 →

📋 Description

A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the "dbrecover.php" and "netremap.php" modules where unsanitized GET parameters are directly embedded into HTML output. This allows an attacker to inject arbitrary JavaScript when an authenticated user clicks a crafted link, provided the required conditions (such as a network defined in the system) are met.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-40457
https://github.com/chilek/lms/commit/9c5651b39bfd086cc34fc9a78ddaa8c0815af114
https://cert.pl/posts/2026/06/CVE-2026-40455
https://lms.org.pl
https://github.com/advisories/GHSA-3vrh-xvg4-68rm