CVE-2026-96777

Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection

State: Published
Severity: 5.3 Medium
Published: Sep 24, 2026
Updated: Sep 29, 2026
Reserved: Sep 23, 2026

Description

A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-89 SQL Injection
CWE-74 Injection

Affected Products

Product	Versions
LMSForma	4.1.0Affected 4.1.1Affected 4.1.2Affected 4.1.3Affected 4.1.4Affected 4.1.5Affected 4.1.6Affected 4.1.7Affected 4.1.8Affected 4.1.9Affected 4.1.10Affected 4.1.11Affected 4.1.12Affected 4.1.13Affected 4.1.14Affected 4.1.15Affected 4.1.16Affected 4.1.17Affected 4.1.18Affected 4.1.19Affected 4.1.20Affected 4.1.21Affected 4.1.22Affected 4.1.23Affected 4.1.24Affected and 19 more versions

References

VDB-409034 | Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injectionvdb-entrytechnical-description
VDB-409034 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-96777 | CVE Analysis and Reportthird-party-advisory
Submit #905111 | Formalms forma.lms 4.1.43 SQL Injectionthird-party-advisory
https://github.com/lorenzobruno7/advisory_formalms_sql/tree/mainrelated
https://github.com/lorenzobruno7/advisory_formalms/tree/mainexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.