Forma vulnerabilities
We track 3 vulnerabilities in Forma products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 31, 2022.
Latest Forma vulnerabilities
- 8.8 High severity
Forma LMS: Unrestricted Upload of File with Dangerous Type
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerabilit
- 8.8 High severity
Forma LMS: Improper Neutralization of Special Elements used in an SQL Command
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'id' parameter in the 'appCore/
- 8.8 High severity
Forma LMS: Unrestricted Upload of File with Dangerous Type
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability