CVE-2020-36998
forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting
CVSS Score
6.4
EPSS Score
0.0%
EPSS Percentile
0th
Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrary JavaScript without proper input sanitization.
| CWE | CWE-79 |
| Vendor | forma |
| Product | e-learning suite |
| Published | Jan 30, 2026 |
| Last Updated | May 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for forma e-learning suite
Be the first to know when new medium vulnerabilities affecting forma e-learning suite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
forma / E-Learning Suite
0 ≤ 2.3.0.2
References
exploit-db.com: https://www.exploit-db.com/exploits/48478 sourceforge.net: https://sourceforge.net/projects/forma/ sourceforge.net: https://sourceforge.net/projects/forma/files/latest/download vulncheck.com: https://www.vulncheck.com/advisories/formalms-the-e-learning-suite-persistent-cross-site-scripting
Credits
Daniel Ortiz