CVEvulnerability

CVE-2025-56748

6.4 MEDIUM Published 2025-10-15 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-10-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.4 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-640

Description

Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.

Affected configurations

• creativeitem academy lms (<= 5.13)

Related

Weakness · CWE (1)

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References