forma vulnerabilities

Products

• Forma LMS 6
• E-Learning Suite 1
• lms 1

Latest forma CVEs

Newest publication first

1. CVE-2026-96777 Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection

   Published 2026-09-24

   Medium·CVSS 5.3 EPSS 0.20%

   A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Nam...

2. CVE-2020-36998 forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting

   Published 2026-01-30

   Medium·CVSS 5.1 EPSS 0.30%

   Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrary JavaScript without...

3. CVE-2022-41679 Cross-site scripting in Forma LMS version

   Published 2022-10-31

   Medium·CVSS 6.1 EPSS 0.56%

   Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “back_url” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vulnerability could allow...

4. CVE-2022-42924 SQL injection in Forma LMS

   Published 2022-10-31

   Medium·CVSS 6.5 EPSS 0.53%

   Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'dyn_filter' parameter in the 'appLms/ajax.adm_serv...

5. CVE-2022-41681 File Upload vulnerability in Forma LMS

   Published 2022-10-31

   High·CVSS 8.8 EPSS 1.0%

   There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability could lead to a rem...

6. CVE-2022-41680 SQL Injection in Forma LMS

   Published 2022-10-31

   Medium·CVSS 6.5 EPSS 0.34%

   Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'search[value] parameter in the appLms/ajax.server....

7. CVE-2022-42925 Unrestricted Upload of File with Dangerous Type in Forma LMS

   Published 2022-10-31

   High·CVSS 8.8 EPSS 1.0%

   There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a re...

8. CVE-2022-42923 SQL injection in Forma LMS

   Published 2022-10-31

   High·CVSS 8.8 EPSS 0.71%

   Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'id' parameter in the 'appCore/index.php?r=adm/medi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.