Formalms records

16 published records for vendor formalms.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

16 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
44Plan	CVE-2021-43136Proof of concept	An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to tformalms · formalms · CWE-798 Pre-auth Auth bypass Hard-coded credentials	Critical9.8	—	15.7%	Nov 10, 2021
39Monitor	CVE-2022-27104No exploit	An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3.formalms · formalms · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.2%	Apr 19, 2022
35Monitor	CVE-2019-5112No exploit	Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.formalms · formalms · CWE-89 SQL injection	High8.8	—	1.6%	Dec 3, 2019
35Monitor	CVE-2019-5111No exploit	Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.formalms · formalms · CWE-89 SQL injection	High8.8	—	1.3%	Dec 3, 2019
35Monitor	CVE-2019-5109No exploit	Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1.formalms · formalms · CWE-89 SQL injection	High8.8	—	1.0%	Dec 3, 2019
35Monitor	CVE-2019-5110No exploit	Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1.formalms · formalms · CWE-89 SQL injection	High8.8	—	1.0%	Dec 3, 2019
35Monitor	CVE-2022-42925No exploit	Unrestricted Upload of File with Dangerous Type in Forma LMSformalms · formalms · CWE-434 RCE File upload	High8.8	—	0.9%	Oct 31, 2022
35Monitor	CVE-2022-41681No exploit	File Upload vulnerability in Forma LMSformalms · formalms · CWE-434 RCE File upload	High8.8	—	0.9%	Oct 31, 2022
35Monitor	CVE-2020-26802No exploit	forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET reformalms · formalms · CWE-352 Pre-auth CSRF	High8.8	—	0.6%	Oct 8, 2020
35Monitor	CVE-2022-42923No exploit	SQL injection in Forma LMSformalms · formalms · CWE-89 SQL injection	High8.8	—	0.6%	Oct 31, 2022
26Monitor	CVE-2022-42924No exploit	SQL injection in Forma LMSformalms · formalms · CWE-89 SQL injection	Medium6.5	—	0.4%	Oct 31, 2022
26Monitor	CVE-2022-41680No exploit	SQL Injection in Forma LMSformalms · formalms · CWE-89 SQL injection	Medium6.5	—	0.3%	Oct 31, 2022
24Monitor	CVE-2022-41679No exploit	Cross-site scripting in Forma LMS versionformalms · formalms · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Oct 31, 2022
24Monitor	CVE-2023-46693No exploit	Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters.formalms · formalms · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.4%	Dec 7, 2023
21Monitor	CVE-2026-26744Proof of concept	A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpformalms · formalms · CWE-204 Pre-auth	Medium5.3	—	0.3%	Feb 19, 2026
18Monitor	CVE-2014-5257No exploit	Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or Hformalms · formalms · CWE-79 Pre-auth XSS	Medium4.3	—	1.8%	Nov 6, 2014

CVE-2021-43136
44Plan
An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to t
CriticalCVSS 9.8Proof of conceptEPSS 15%
formalms · formalmsNov 10, 2021
CVE-2022-27104
39Monitor
An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
formalms · formalmsApr 19, 2022
CVE-2019-5112
35Monitor
Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
formalms · formalmsDec 3, 2019
CVE-2019-5111
35Monitor
Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
formalms · formalmsDec 3, 2019
CVE-2019-5109
35Monitor
Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1.
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
formalms · formalmsDec 3, 2019
CVE-2019-5110
35Monitor
Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1.
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
formalms · formalmsDec 3, 2019
CVE-2022-42925
35Monitor
Unrestricted Upload of File with Dangerous Type in Forma LMS
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
formalms · formalmsOct 31, 2022
CVE-2022-41681
35Monitor
File Upload vulnerability in Forma LMS
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
formalms · formalmsOct 31, 2022
CVE-2020-26802
35Monitor
forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET re
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
formalms · formalmsOct 8, 2020
CVE-2022-42923
35Monitor
SQL injection in Forma LMS
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
formalms · formalmsOct 31, 2022
CVE-2022-42924
26Monitor
SQL injection in Forma LMS
MediumCVSS 6.5No exploitEPSS 0%
- SQL injection
formalms · formalmsOct 31, 2022
CVE-2022-41680
26Monitor
SQL Injection in Forma LMS
MediumCVSS 6.5No exploitEPSS 0%
- SQL injection
formalms · formalmsOct 31, 2022
CVE-2022-41679
24Monitor
Cross-site scripting in Forma LMS version
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
formalms · formalmsOct 31, 2022
CVE-2023-46693
24Monitor
Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters.
MediumCVSS 6.1No exploitEPSS 0%
- pre-auth RCE
- XSS
formalms · formalmsDec 7, 2023
CVE-2026-26744
21Monitor
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endp
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
formalms · formalmsFeb 19, 2026
CVE-2014-5257
18Monitor
Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or H
MediumCVSS 4.3No exploitEPSS 1%
- Pre-auth
- XSS
formalms · formalmsNov 6, 2014