CVE-2026-96777

Overview

Forma LMS versions up to 4.1.43 are vulnerable to a remote SQL injection via the UserselectorAdmController::getDataTask endpoint. The flaw allows attackers to manipulate the Name parameter and execute arbitrary SQL queries. This can lead to data exposure or modification.

Description

A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

The vulnerability compromises Confidentiality by allowing attackers to read sensitive data, Integrity by enabling unauthorized data modification, and Availability if the database is overwhelmed. Defenders are primarily web application administrators and database administrators who must secure the affected endpoint.

Remediation

Upgrade Forma LMS to version 4.1.44 or later where the injection is fixed. If an upgrade is not immediately possible, apply input validation to the Name parameter, enforce strict parameterized queries, and deploy a WAF rule to block suspicious SQL patterns. Additionally, monitor database logs for anomalous query activity and restrict database user privileges to the minimum required.

Risk context

The CVSS v3 score of 6.3 indicates medium risk, and the EPSS of 0.002 suggests a low probability of exploitation in the near term. However, the public disclosure and lack of vendor response warrant prompt mitigation to prevent potential data breaches.

Affected products

• Forma LMS 4.1.43
• Forma LMS 4.1.42
• Forma LMS 4.1.41
• Forma LMS 4.1.40
• Forma LMS 4.1.39
• Forma LMS 4.1.38
• Forma LMS 4.1.37
• Forma LMS 4.1.36