CVE-2026-96777 | Forma LMS up to 4.1.43 Multi-User-Selector AJAX Endpoint getData getDataTask Name sql injection

September 23, 2026 Yanac

A vulnerability identified as critical has been detected in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql injection.

This vulnerability appears as CVE-2026-96777. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More