CVE-2025-56748

{
  "id": "CVE-2025-56748",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-15T15:16:04.610",
  "lastModified": "2026-11-05T22:10:00.203",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts."
    },
    {
      "lang": "es",
      "value": "Creativeitem Academy LMS hasta e incluyendo la 5.13 utiliza tokens de restablecimiento de contraseña predecibles basados en plantillas codificadas en Base64 sin limitación de velocidad, lo que permite ataques de fuerza bruta para adivinar tokens de restablecimiento válidos y comprometer cuentas de usuario."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-15T17:50:11.502624Z",
          "id": "CVE-2025-56748",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-640"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:creativeitem:academy_lms:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "5.13",
              "matchCriteriaId": "EEDDA428-3C2A-4CB6-B809-9859B79F2486"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e7t9y/",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ]
    }
  ]
}