A reflected Cross‑Site Scripting flaw exists in LMS (LAN Management System). Unsanitized GET parameters in the dbrecover.php and netremap.php modules are directly inserted into the HTML response, allowing an attacker to inject arbitrary JavaScript. When an authenticated user follows a crafted link that contains the vulnerable parameters, the injected script executes in that user’s browser session. The impact is that the attacker can execute JavaScript with the privileges of the logged‑in user within the interface, enabling actions such as phishing, data exfiltration, or further malicious activity in the client’s browser.

Every LMS installation built prior to the code change commit 9c5651b is affected. The vulnerability applies to all instances of the product before this commit, regardless of the product version number. No other vendors or products are mentioned as impacted.

The CVSS score of 2.1 indicates a low‑severity flaw. EPSS information is unavailable and the vulnerability is not listed in CISA KEV, suggesting active exploitation is unlikely at this time. Exploitation requires social engineering to entice an authenticated user to click a malicious link containing the vulnerable parameters, and the presence of a defined network in the system. Because the attack relies on user interaction and a specific configuration, the likelihood of widespread attacks is reduced, though the damage to the individual user’s session remains significant if successful.