PatchTheCVECVE-2025-56748: Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encod
CVE-2025-56748 is a medium-severity flaw (CVSS 6.4) affecting academy lms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 87%) |
| CISA exploited list | No |
| Weakness | CWE-640 |
| Published | 2025-10-15 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-56748?
academy lms: upgrade to newer than 5.13. Exact commands for each OS are on this page.
Is CVE-2025-56748 being exploited?
CVE-2025-56748 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-56748 affect?
CVE-2025-56748 affects academy lms. Severity is medium (CVSS 6.4). Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
How urgent is CVE-2025-56748?
Priority 31/100. Public exploit reference
Related CVEs
- CVE-2025-71179 MEDIUM 6.1 DOWNGRADE Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search para
- CVE-2025-56749 CRITICAL 9.4 UPGRADE Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing
- CVE-2025-56747 MEDIUM 6.5 UPGRADE Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_ins
- CVE-2025-56746 LOW 2.2 UPGRADE Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authenticati
- CVE-2024-38959 MEDIUM 6.1 DOWNGRADE Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a rem