Skip to content
OpenAdvisories

Vendor

Forma

8 known vulnerabilities.

Forma at a glance

Last 12 months
2
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202610
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Forma LMS 6 E-Learning Suite 1 LMS 1
All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 6.3
    CVE-2026-96777

    Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection

    A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulatio…

    Forma LMS
  • Medium 6.4
    CVE-2020-36998

    forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting

    Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrar…

    Forma E-Learning Suite
  • Medium 4.7
    CVE-2022-41679

    Cross-site scripting in Forma LMS version

    Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “back_url” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vuln…

    Forma Forma LMS
  • High 7.6
    CVE-2022-42924

    SQL injection in Forma LMS

    Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'dyn_filter' parameter in the …

    Forma Forma LMS
  • Critical 9.9
    CVE-2022-41681

    File Upload vulnerability in Forma LMS

    There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerabilit…

    Forma Forma LMS
  • High 7.6
    CVE-2022-41680

    SQL Injection in Forma LMS

    Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'search[value] parameter in th…

    Forma Forma LMS
  • Critical 9.9
    CVE-2022-42925

    Unrestricted Upload of File with Dangerous Type in Forma LMS

    There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerabili…

    Forma Forma LMS
  • High 8.3
    CVE-2022-42923

    SQL injection in Forma LMS

    Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'id' parameter in the 'appCore…

    Forma Forma LMS