Predictable Password Reset Vulnerability in Creativeitem Academy LMS
CVE-2025-56748

6.4MEDIUM

Key Information:

Vendor

Creativeitem

Status
Academy LMS
Vendor
CVE Published:
15 October 2025

What is CVE-2025-56748?

The Creativeitem Academy LMS, up to version 5.13, is susceptible to a vulnerability that involves predictable password reset tokens. These tokens, which are based on Base64 encoded templates, lack proper rate limiting, allowing attackers to execute brute force attacks. This flaw enables potential unauthorized access to user accounts by guessing valid reset tokens, posing significant security risks.

References

https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.