CVE-2026-26744 | Medium | 5.3 | 2026-02-19 | A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The applicati… |
CVE-2020-36960 | Medium | 6.4 | 2026-01-26 | Forma LMS 2.3 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into user profile first and last name fiel… |
CVE-2023-46693 | Medium | 6.1 | 2023-12-07 | Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters. |
CVE-2022-42925 | Critical | 9.9 | 2022-10-31 | There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in… |
CVE-2022-42924 | High | 7.6 | 2022-10-31 | Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated… |
CVE-2022-42923 | High | 8.3 | 2022-10-31 | Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated… |
CVE-2022-41681 | Critical | 9.9 | 2022-10-31 | There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in… |
CVE-2022-41680 | High | 7.6 | 2022-10-31 | Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated… |
CVE-2022-41679 | Medium | 4.7 | 2022-10-31 | Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the… |
CVE-2022-27104 | Critical | 9.8 | 2022-04-19 | An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3. |
CVE-2021-43136 | Critical | 9.8 | 2021-11-10 | An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform. |
CVE-2020-26802 | High | 8.8 | 2020-10-08 | forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the… |
CVE-2019-5112 | High | 8.8 | 2019-12-03 | Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_status was… |
CVE-2019-5111 | High | 8.8 | 2019-12-03 | Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_cat was co… |
CVE-2019-5110 | High | 8.8 | 2019-12-03 | Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An at… |
CVE-2019-5109 | High | 8.8 | 2019-12-03 | Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An a… |
CVE-2014-5257 | | | 2014-11-06 | Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the (1) id_… |