EUVD-2022-44865

Malicious code in bioql PyPI...

CVE-2022-41680: Improper Neutralization of Special Elements used in an SQL Command

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'searchvalue parameter in the...

CVE-2019-5112

Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filterstatus was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with...

PT-2019-17483

Name of the Vulnerable Software and Affected Versions Forma LMS version 2.2.1 Description A SQL injection issue exists in the authenticated portion of the software. The "API Endpoint" /appLms/ajax.server.php and the parameter filter cat are vulnerable to SQL injections, which can be exploited by...

PT-2019-17484

Name of the Vulnerable Software and Affected Versions Forma LMS version 2.2.1 Description An exploitable SQL injection vulnerability exists in the authenticated portion of the software. The /appLms/ajax.server.php URL and the filter status parameter are affected, allowing authenticated attackers ...

CVE-2019-5111: Improper Neutralization of Special Elements used in an SQL Command

Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filtercat was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with parameters...