{"id":"CVE-2020-36998","state":"PUBLISHED","title":"forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting","description":"Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrary JavaScript without proper input sanitization.","publishedAt":"2026-01-30T16:16:37.882Z","updatedAt":"2026-05-14T02:06:46.920Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["forma E-Learning Suite"],"affected":[{"vendor":"forma","product":"E-Learning Suite","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.3.0.2","versionType":"custom"}]}],"references":["https://www.exploit-db.com/exploits/48478","https://sourceforge.net/projects/forma/","https://sourceforge.net/projects/forma/files/latest/download","https://www.vulncheck.com/advisories/formalms-the-e-learning-suite-persistent-cross-site-scripting"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:47:24.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/36xxx/CVE-2020-36998.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-36998","state":"PUBLISHED","datePublished":"2026-01-30T16:16:37.882Z","dateUpdated":"2026-05-14T02:06:46.920Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-27T15:47:08.000Z"},"containers":{"cna":{"title":"forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting","descriptions":[{"lang":"en","value":"Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrary JavaScript without proper input sanitization."}],"affected":[{"vendor":"forma","product":"E-Learning Suite","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.3.0.2","versionType":"custom"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/48478","name":"ExploitDB-48478","tags":["exploit"]},{"url":"https://sourceforge.net/projects/forma/","name":"Vendor Homepage","tags":["product"]},{"url":"https://sourceforge.net/projects/forma/files/latest/download","name":"Software Download Link","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/formalms-the-e-learning-suite-persistent-cross-site-scripting","name":"VulnCheck Advisory: forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-05-14T02:06:46.920Z"},"datePublic":"2020-05-15T00:00:00.000Z","credits":[{"lang":"en","value":"Daniel Ortiz","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-30T16:30:47.213656Z","id":"CVE-2020-36998","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-30T16:30:54.395Z"}}]}}}