THREATIST.IORead the docs No Forma vulnerabilities are listed in CISA KEV.
16 records in Formalms · all components
An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload componen…
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature…
An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3.
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability.
Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.
Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.
Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1.
Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1.
forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the admin email address in order to accomplish an account takeov…
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability.
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability.
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint.
Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “back_url” parameter in appLms/index.php?modname=faq&op=play…
Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters.
Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the (1) id_custom parameter in an amanmenu request or (2) id_game parame…