CVE-2020-36960

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.4 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N                                    

Vulnerability Description

Forma LMS 2.3 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into user profile first and last name fields. Attackers can craft scripts like '<script>alert(document.cookie)</script>' to execute arbitrary JavaScript when the profile is viewed by other users.

Vulnerability Details

Published Date

January 26, 2026

Last Modified

January 27, 2026

CWE ID

CWE-79

Source

NVD

Vendor

Formalms

Product

Forma LMS

External References

https://www.exploit-db.com/exploits/49197
https://www.formalms.org/
https://www.vulncheck.com/advisories/forma-lms-first-last-name-stored-cross-site-scripting

CVE-2020-36960

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment