Predictable Password Reset Vulnerability in Creativeitem Academy LMS
CVE-2025-56748

6.4MEDIUM

Key Information:

Vendor

Creativeitem

Status
Academy LMS
Vendor
CVE Published:
15 October 2025

What is CVE-2025-56748?

The Creativeitem Academy LMS, up to version 5.13, is susceptible to a vulnerability that involves predictable password reset tokens. These tokens, which are based on Base64 encoded templates, lack proper rate limiting, allowing attackers to execute brute force attacks. This flaw enables potential unauthorized access to user accounts by guessing valid reset tokens, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.