CVE-2026-94380

HighCVSS 8.1

Published: 26/10/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS from 2.3.4-1124 before 2.3.5-1131.

Risk Assessment

An attacker could take over an account by abusing the password recovery process. This poses a risk of unauthorized access to the management system.

Recommendation

Update Liman MYS to version 2.3.5-1131 or later.

Other vulnerabilities in Liman MYS

See all

CVE-2026-105457Medium
HAVELSAN Inc. Liman MYS contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. This issue affects Liman MYS before version 2.3.5-1132.
CVE-2026-19532Medium
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS from 2.3.2 before 2.3.4-1124.
CVE-2026-18650High
Liman MYS from 2.2.3 before 2.3.1 has a missing authorization vulnerability allowing privilege escalation.
CVE-2026-17070High
Liman MYS from 2.2.3 before 2.3.1 has a missing authorization vulnerability allowing access to functionality not properly constrained by ACLs.
CVE-2026-13696High
An LDAP injection vulnerability in HAVELSAN Inc. Liman MYS allows an attacker to manipulate LDAP queries due to improper neutralization of special elements. The issue affects versions before release.Master.1107.
CVE-2026-11348High
An improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows fake the source of data. This issue affects Liman MYS versions before release.Master.1107.
CVE-2026-11340High
A missing authorization vulnerability in HAVELSAN Inc. Liman MYS allows accessing functionality not properly constrained by ACLs. This issue affects versions before release.Master.1107.

Original NVD description (English source)

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS