41 matches found
CVE-2026-26744
CVE-2026-26744 A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames e.g., "The username you've inserted doesn't exist. Plea...
Formalms Exposed Installation Detection
Formalms Installation is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Formalms Installation is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Formalms Exposed Installation Detection', 'description'...
CVE-2026-26744
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...
CVE-2026-26744
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...
CVE-2026-26744
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...
CVE-2026-26744
A user enumeration vulnerability exists in FormaLMS versions 4.1.18 and below within the password recovery functionality accessible via the /lostpwd endpoint. The application returns distinct error messages for valid and invalid usernames—for example, stating "The username you've inserted doesn't...
CVE-2026-26744
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...
PT-2026-20941
Name of the Vulnerable Software and Affected Versions FormaLMS versions 4.1.18 and below Description A flaw exists in the password recovery functionality of FormaLMS that allows for user enumeration. An unauthenticated attacker can determine valid registered usernames by observing differing error...
CVE-2026-26744
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...
CVE-2026-26744
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...
CVE-2026-26744: Observable Response Discrepancy
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...
EUVD-2023-50880
Malicious code in bioql PyPI...
CVE-2021-43136
An authentication bypass issue in FormaLMS = 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform...
FormaLMS Cross-Site Scripting Vulnerability
FormaLMS is an open source learning management system. It is used to build around the specific needs of corporate training. A cross-site scripting vulnerability exists in FormaLMS versions prior to 4.0.5, which stems from the application's lack of effective filtering and escaping of user-supplied...
CVE-2023-46693
Cross Site Scripting XSS vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters...
CVE-2023-46693
Cross Site Scripting XSS vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters...
CVE-2023-46693
Cross Site Scripting XSS vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters...
Cross site scripting
Cross Site Scripting XSS vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters...
PT-2023-30162
Name of the Vulnerable Software and Affected Versions FormaLMS versions prior to 4.0.5 Description The issue allows attackers to run arbitrary code via title parameters, potentially leading to the execution of malicious scripts. This is a Cross Site Scripting XSS issue. Recommendations For versio...
