CVE-2025-56748
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
53/100
Published: 2025-10-15
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
No Auth
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
Low
A:
Low
Description
Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| creativeitem | academy_lms | < 5.13 |
References & Advisories (1)
Exploit
Mitigation
Third Party Advisory