Formalms' vulnerability profile centers on a single learning-management and course-delivery platform that occupies an education-sector niche but carries elevated severity risk. Its disclosures recur around application-level input-handling and state-management weaknesses—SQL injection, cross-site scripting, unsafe file uploads, cross-site request forgery, and response-timing disclosure—that are characteristic of web applications handling user-generated content and administrative workflows, and a meaningful share of its vulnerabilities acquire public exploit code. Defenders should monitor this vendor's updates closely given the education sector's reliance on such platforms and the presence of student and institutional data; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Formalms over time
Signals from CVEs in this vendor scope (17 CVEs).
17 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-43136CRITICAL An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform. | Nov 10, 2021 | 9.8 | 50 | NO | YES |
CVE-2022-27104CRITICAL An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3. | Apr 19, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-42923HIGH Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the ro | Oct 31, 2022 | 8.8 | 28 | NO | NO |
CVE-2022-42925HIGH There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip | Oct 31, 2022 | 8.8 | 27 | NO | NO |
CVE-2022-41681HIGH There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip | Oct 31, 2022 | 8.8 | 27 | NO | NO |
CVE-2019-5112HIGH Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_status was confirmed to suffer | Dec 3, 2019 | 8.8 | 27 | NO | NO |
CVE-2019-5111HIGH Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_cat was confirmed to suffer fro | Dec 3, 2019 | 8.8 | 27 | NO | NO |
CVE-2019-5110HIGH Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web | Dec 3, 2019 | 8.8 | 27 | NO | NO |
CVE-2019-5109HIGH Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a we | Dec 3, 2019 | 8.8 | 26 | NO | NO |
CVE-2022-42924MEDIUM Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the ro | Oct 31, 2022 | 6.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (17 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Formalms.
Media articles that mention a CVE ID that affects a product developed by Formalms — matched by CVE ID, not by vendor name.