CVE-2022-41679

Cross-site scripting in Forma LMS version

State: Published
Severity: 4.7 Medium
Published: Oct 31, 2022
Updated: May 2, 2025
Reserved: Sep 28, 2022

Description

Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “back_url” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vulnerability could allow an attacker to steal the user´s cookies in order to log in to the application.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N	INCIBE

Weaknesses

CWE-79 improper neutralization of input during web page generation (Cross-site Scripting)

Affected Products

Product	Versions
Forma LMSForma	3.0.1 through 3.1.0Affected

References

https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-forma-lms

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.