Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
References
| Link | Resource |
|---|---|
| https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e7t9y/ | Exploit Mitigation Third Party Advisory |
Configurations
History
21 Oct 2025, 19:24
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:creativeitem:academy_lms:*:*:*:*:*:*:*:* | |
| References | () https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e7t9y/ - Exploit, Mitigation, Third Party Advisory | |
| First Time |
Creativeitem academy Lms
Creativeitem |
15 Oct 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-640 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.4 |
15 Oct 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-15 15:16
Updated : 2025-10-21 19:24
NVD link : CVE-2025-56748
Mitre link : CVE-2025-56748
CVE.ORG link : CVE-2025-56748
JSON object : View
Products Affected
creativeitem
- academy_lms
CWE
CWE-640
Weak Password Recovery Mechanism for Forgotten Password