PT-2026-20941 · Forma Lms · Forma Lms

Lorenzo Bruno · Publicado 2026-02-19 · Atualizado 2026-02-24 · CVE-2026-26744

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FormaLMS versions 4.1.18 and below

Description A flaw exists in the password recovery functionality of FormaLMS that allows for user enumeration. An unauthenticated attacker can determine valid registered usernames by observing differing error messages returned by the application. This is accessible via the /lostpwd API endpoint. The application reveals whether a username exists based on the response received.

Recommendations Versions prior to 4.1.18 should be updated.

Exploit

Correção

Enumeração de Fraquezas

CWE-204

Identificadores relacionados

CVE-2026-26744

Produtos afetados

Forma Lms

Referências · 7

• 🔥 https://github.com/lorenzobruno7/CVE-2026-26744 · Exploit
• ❌ https://github.com/formalms/formalms.git · Nota, Deleted
• https://t.me/cveNotify/153029 · Publicação no Telegram
• https://twitter.com/UndercodeUpdate/status/2024990552576385106 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026265070573871318 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26744 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-26744 · Nota de Segurança