Forma LMS vulnerabilities
3 known vulnerabilities in Forma LMS from Forma. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Forma LMS: Unrestricted Upload of File with Dangerous Type
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerabilit
- 8.8 High severity
Forma LMS: Improper Neutralization of Special Elements used in an SQL Command
Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'id' parameter in the 'appCore/
- 8.8 High severity
Forma LMS: Unrestricted Upload of File with Dangerous Type
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability