Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-96777: Forma LMS lets remote attackers run database commands
CVE-2026-96777 · published 25 days ago
Summary
Versions of Forma LMS up to 4.1.43 let an attacker send specially crafted data to the multi‑user selector feature and cause the system to run unintended database queries. This could allow the attacker to view, change or delete information stored by the LMS. Apply the latest update from the vendor or use a security patch that validates the input, and restrict network access to the LMS admin interface.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| forma | lms | 4.1.0 |
Original advisory text
Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection
A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-89SQL Injection
CWE-74Injection
Timeline
Published24 Sep 2026
Updated19 Oct 2026
First seen24 Sep 2026
Track software like this
Free during beta