CVE-2026-40457

Name of the Vulnerable Software and Affected Versions LMS (LAN Management System) versions prior to commit 9c5651b

Description A Reflected Cross-Site Scripting (XSS) issue exists in the "dbrecover.php" and "netremap.php" modules. This occurs because unsanitized GET parameters are directly embedded into the HTML output. An attacker can inject arbitrary JavaScript if an authenticated user clicks a specially crafted link, assuming specific conditions, such as a defined network in the system, are met.

Recommendations Update to commit 9c5651b or a newer version. As a temporary workaround, restrict access to the "dbrecover.php" and "netremap.php" modules to minimize the risk of exploitation.