CVE-2018-12090 | BDVDB-2026-102467 Detail

Description#

There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://bugs.lamsfoundation.org/browse/LDEV-4600
https://www.exploit-db.com/exploits/45153/

Exploit#

https://www.exploit-db.com/exploits/45153/

History#

Version 12018-06-11Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.