CVE-2025-56748

6.4 mediumEPSS 0.2%

Medium (6.4) in creativeitem academy lms. EPSS 0.2% chance of exploitation in the next 30 days.

Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.

Severity

CVSS 3.1

6.4 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-640
Published: 2025-10-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

creativeitem:academy_lms

References

https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e7t9y/

Check your stack JSON