Forma Learning Management System SQL Injection Vulnerability

Forma Learning Management System LMS is a learning management system LMS. A SQL injection vulnerability exists in the Forma Learning Management System. An attacker could exploit this vulnerability by sending a specially crafted web request to disclose database user credentials and access the...

CVE-2019-5112

Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filterstatus was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with...

CVE-2019-5111

Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filtercat was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with parameters...

PT-2019-17481

Name of the Vulnerable Software and Affected Versions Forma LMS version 2.2.1 Description Exploitable SQL injection vulnerabilities exist in the authenticated portion of the software. Specially crafted web requests can cause SQL injections, potentially allowing exfiltration of the database, user...

PT-2019-17484

Name of the Vulnerable Software and Affected Versions Forma LMS version 2.2.1 Description An exploitable SQL injection vulnerability exists in the authenticated portion of the software. The /appLms/ajax.server.php URL and the filter status parameter are affected, allowing authenticated attackers ...

PT-2019-17482

Name of the Vulnerable Software and Affected Versions Forma LMS version 2.2.1 Description Exploitable SQL injection vulnerabilities exist in the authenticated portion of the software. Specially crafted web requests can cause SQL injections, allowing an attacker to send a web request with paramete...

CVE-2019-5110: Improper Neutralization of Special Elements used in an SQL Command

Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

CVE-2019-5112: Improper Neutralization of Special Elements used in an SQL Command

Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filterstatus was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with...

CVE-2019-5109: Improper Neutralization of Special Elements used in an SQL Command

Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

CVE-2019-5111: Improper Neutralization of Special Elements used in an SQL Command

Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filtercat was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with parameters...

PT-2019-17483

Name of the Vulnerable Software and Affected Versions Forma LMS version 2.2.1 Description A SQL injection issue exists in the authenticated portion of the software. The "API Endpoint" /appLms/ajax.server.php and the parameter filter cat are vulnerable to SQL injections, which can be exploited by...

Vulnerability Spotlight: SQL injection vulnerabilities in Forma Learning Management System

Yuri Kramarz of Security Advisory EMEAR discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered three SQL injection vulnerabilities in the authenticated portion of the Formal Learning Management System. LMS is a set of software that allows companies to build and hos...

Forma LMS 2.2.1 /appCore/index.php users parameter SQL injections

Summary Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

Forma LMS 2.2.1 /appLms/ajax.server.php filter_cat and filter_status parameters SQL injections

Summary Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

Forma LMS 2.2.1 ajax.adm_server.php dir parameter SQL injections

Summary Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowin...

PT-2017-16878

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 1.x Form Builder before version 0.8.1.6 Description The issue allows remote attackers to execute PHP code. This is achieved via the cntnt01fbrp forma form template parameter in the admin store form endpoint...

ecole-forma-study.com XSS vulnerability

Open Bug Bounty ID: OBB-193357 Description| Value ---|--- Affected Website:| ecole-forma-study.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Threat Outbreak Alert RuleID21769: Email Messages Distributing Malicious Software on March 20, 2016

Medium Alert ID: 44219 First Published: 2016 March 21 13:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID21769 may contain the following files: Name | Si...

Forma Lms SQL Injection Vulnerability

Forma Lms is an open source web-based learning management system LMS. A SQL injection vulnerability exists in Forma Lms, which allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain database data...

Forma LMS 1.3 - Multiple SQL Injections

Forma LMS 1.3 - Multiple SQL Injections Forma LMS 1.3 Multiple SQL Injections + Author: Filippo Roncari + Target: Forma LMS + Version: 1.3 and probably lower + Vendor: http://www.formalms.org + Accessibility: Remote + Severity: High + CVE: + Full Advisory:...