Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
References
| Link | Resource |
|---|---|
| https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e7t9y/ | Exploit Mitigation Third Party Advisory |
Configurations
History
21 Oct 2025, 19:24
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:creativeitem:academy_lms:*:*:*:*:*:*:*:* | |
| First Time |
Creativeitem
Creativeitem academy Lms |
|
| References | () https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e7t9y/ - Exploit, Mitigation, Third Party Advisory |
15 Oct 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.4 |
| CWE | CWE-640 |
15 Oct 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-15 15:16
Updated : 2025-10-21 19:24
NVD link : CVE-2025-56748
Mitre link : CVE-2025-56748
CVE.ORG link : CVE-2025-56748
JSON object : View
Products Affected
creativeitem
- academy_lms
CWE
CWE-640
Weak Password Recovery Mechanism for Forgotten Password