Medium severity6.1NVD Advisory· Published Jun 11, 2018· Updated Jun 17, 2026

CVE-2018-12090

Description

There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lamsfoundation/Lams
cpe:2.3:a:lamsfoundation:lams:*:*:*:*:*:*:*:*
Range: <3.1

Patches

Vulnerability mechanics

References

bugs.lamsfoundation.org/browse/LDEV-4600nvdExploitIssue TrackingThird Party Advisory
www.exploit-db.com/exploits/45153/nvdExploitThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.002
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000