forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting | Advisories

Advisories

forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting

severity: medium
date: January 30, 2026
Affecting: E-Learning Suite <= 2.3.0.2
CVE: CVE-2020-36998
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: ExploitDB-48478
Vendor Homepage
Software Download Link
Credit: Daniel Ortiz
Description: Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrary JavaScript without proper input sanitization.