CVE-2020-36998

Impact

Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrary JavaScript without proper input sanitization.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://sourceforge.net/projects/forma/
• https://sourceforge.net/projects/forma/files/latest/download
• https://www.exploit-db.com/exploits/48478
• https://www.vulncheck.com/advisories/formalms-the-e-learning-suite-persistent-cross-site-scripting