CVE-2014-5257

CVE-2014-5257 affects Forma Lms prior to 1.2.1 p01, with two reflected XSS vulnerabilities in appCore/index.php exploitable via id_custom (amanmenu) and id_game (alms/games/edit). Advisory HTB23226 describes insufficient sanitization leading to arbitrary HTML/script execution in the context of a ...

Forma Lms 1.2.1 Cross Site Scripting

Advisory ID: HTB23226 Product: Forma Lms Vendor: http://www.formalms.org/ Vulnerable Versions: 1.2.1 and probably prior Tested Version: 1.2.1 Advisory Publication: August 6, 2014 without technical details Vendor Notification: August 6, 2014 Vendor Patch: November 4, 2014 Public Disclosure: Novemb...

Two Reflected Cross-Site Scripting (XSS) Vulnerabilities in Forma Lms

High-Tech Bridge Security Research Lab discovered two vulnerabilities in Forma Lms, which can be exploited to perform Cross-Site Scripting XSS attacks against vulnerable website. 1 Reflected Cross-Site Scripting XSS in Forma Lms: CVE-2014-5257 1.1 The vulnerability exists due to insufficient...