PT-2026-5413 · Unknown · Forma.Lms The E-Learning Suite

Daniel Ortiz · Published 2026-01-30 · Updated 2026-01-30 · CVE-2020-36998

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Forma.lms The E-Learning Suite version 2.3.0.2

Description Forma.lms The E-Learning Suite version 2.3.0.2 contains a persistent cross-site scripting issue in multiple course and profile parameters. Attackers can inject malicious scripts into course code, name, description fields, and the email parameter, leading to the execution of arbitrary JavaScript due to a lack of proper input sanitization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-36998

Affected Products

Forma.Lms The E-Learning Suite

References · 6

• 🔥 https://exploit-db.com/exploits/48478 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36998 · Security Note
• https://t.me/CVEtracker/43300 · Telegram Post
• https://vulncheck.com/advisories/formalms-the-e-learning-suite-persistent-cross-site-scripting · Note
• https://sourceforge.net/projects/forma · Note
• https://sourceforge.net/projects/forma/files/latest/download · Note