CVE-2026-40455EPSS p22.1%

CVE-2026-40455CVE-2026-40455

Description

An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization of the POST "tg[]" parameter. The application directly concatenates user-supplied array values into an SQL query using "implode()", allowing authenticated attackers to perform Error-Based SQL injection and extract sensitive database information.

Scoring

EPSS0.31% probability of exploitation · percentile 22.1% · 2026-10-05T12:00:23Z
Last modified2026-06-18
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.