Three LMS Flaws Expose Databases and Enable Command Injection
Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Jun 18, 2026
CERT Polska disclosed three vulnerabilities in LMS (LAN Management System), including two high-severity issues tracked as CVE-2026-40455 and CVE-2026-40456. The first is an authenticated SQL injection in tarifflist.php before commit 4cb30a7, caused by insufficient sanitization of the POST tg[] parameter and unsafe query construction with implode(), allowing attackers to extract sensitive database information. The second is an OS command injection before commit 9fcb4de, where an IP address parameter is passed to exec() without proper validation, enabling arbitrary operating system command execution.
CERT Polska also reported CVE-2026-40457, a reflected XSS flaw in dbrecover.php and netremap.php before commit 9c5651b that can trigger arbitrary JavaScript execution when an authenticated user opens a crafted link under certain conditions. The SQL injection and command injection bugs were both rated High with CVSS 4.0 base scores of 8.6, and the disclosure credited Tymoteusz Dominik for responsibly reporting the issues. Organizations running LMS versions prior to the referenced commits should prioritize patching and review exposure of authenticated administrative functions.
