Skip to content
OpenAdvisories

Vendor

Forma

8 known vulnerabilities.

Products

Forma LMS 6 E-Learning Suite 1 LMS 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-96777

    Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection

    A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulatio…

    Forma LMS
  • Medium 6.4
    CVE-2020-36998

    forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting

    Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrar…

    Forma E-Learning Suite
  • Medium 4.7
    CVE-2022-41679

    Cross-site scripting in Forma LMS version

    Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “back_url” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vuln…

    Forma Forma LMS