CVE-2026-96777 - Vulnerability Details

- Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection

Description

A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-24

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies within the Multi‑User‑Selector AJAX endpoint of Forma LMS (versions up to 4.1.43). By manipulating the Name parameter sent to the endpoint /appCore/ajax.adm_server.php?r=adm/userselector/getData, an attacker can inject arbitrary SQL statements that are executed against the application’s database. This flaw permits execution of unintended queries, potentially exposing, altering, or destroying database contents, depending on the privileges of the process that handles the request.

Affected Systems

Forma LMS versions 4.1.43 and earlier are affected. Administrators or users who can access the /appCore/ajax.adm_server.php endpoint with the getDataTask function are at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the vulnerability is remotely reachable and publicly disclosed. The CISA KEV catalog does not list this issue. The likely attack vector is HTTP requests to the vulnerable endpoint, which can originate from anywhere on the internet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Forma

LMS

affected

Version	Status	Constraints
`4.1.0`	affected	—
`4.1.1`	affected	—
`4.1.2`	affected	—
`4.1.3`	affected	—
`4.1.4`	affected	—
`4.1.5`	affected	—
`4.1.6`	affected	—
`4.1.7`	affected	—
`4.1.8`	affected	—
`4.1.9`	affected	—
`4.1.10`	affected	—
`4.1.11`	affected	—
`4.1.12`	affected	—
`4.1.13`	affected	—
`4.1.14`	affected	—
`4.1.15`	affected	—
`4.1.16`	affected	—
`4.1.17`	affected	—
`4.1.18`	affected	—
`4.1.19`	affected	—
`4.1.20`	affected	—
`4.1.21`	affected	—
`4.1.22`	affected	—
`4.1.23`	affected	—
`4.1.24`	affected	—
`4.1.25`	affected	—
`4.1.26`	affected	—
`4.1.27`	affected	—
`4.1.28`	affected	—
`4.1.29`	affected	—
`4.1.30`	affected	—
`4.1.31`	affected	—
`4.1.32`	affected	—
`4.1.33`	affected	—
`4.1.34`	affected	—
`4.1.35`	affected	—
`4.1.36`	affected	—
`4.1.37`	affected	—
`4.1.38`	affected	—
`4.1.39`	affected	—
`4.1.40`	affected	—
`4.1.41`	affected	—
`4.1.42`	affected	—
`4.1.43`	affected	—

No data.

Vendor Product Confidence Versions

Forma

Lms

95%

Version	Status	Scheme	Platform
`[4.1.0,4.1.43]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Restrict access to the /appCore/ajax.adm_server.php endpoint to trusted administrators only and enforce strong authentication.
Apply strict input validation or a whitelist to ensure the Name parameter contains only allowed characters and to reject malformed input.
Deploy or configure a Web Application Firewall (WAF) rule set to detect and block SQL injection patterns targeting the getDataTask endpoint.
Regularly monitor application logs for anomalous SQL activity and verify that no unexpected queries are being executed.
Verify that a vendor patch or update is released and apply it as soon as it becomes available.

Generated by OpenCVE AI on September 24, 2026 at 03:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/lorenzobruno7/advisory_formalms/tree/main
https://github.com/lorenzobruno7/advisory_formalms_sql/tree/main
https://vuldb.com/cve/CVE-2026-96777
https://vuldb.com/submit/905111
https://vuldb.com/vuln/409034
https://vuldb.com/vuln/409034/cti

History

Thu, 24 Sep 2026 01:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection
First Time appeared		Forma Forma lms
Weaknesses		CWE-74 CWE-89
CPEs		cpe:2.3:a:forma:lms::::::::
Vendors & Products		Forma Forma lms
References		https://github.com/lorenzobruno7/advisory_formalms/tree/main https://github.com/lorenzobruno7/advisory_formalms_sql/tree/main https://vuldb.com/cve/CVE-2026-96777 https://vuldb.com/submit/905111 https://vuldb.com/vuln/409034 https://vuldb.com/vuln/409034/cti
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Forma Lms

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-24T01:15:11.753Z

Updated: 2026-09-24T01:15:11.753Z

Reserved: 2026-09-23T16:22:20.143Z

Link: CVE-2026-96777

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-09-24T02:16:53.563

Modified: 2026-09-24T14:40:36.103

Link: CVE-2026-96777

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-24T04:00:12Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object