Threats tagged 'ghsa-mvxp-v5m4-5jrc'

CVE-2026-96777 is a SQL injection vulnerability in Forma LMS versions up to 4.1.43. It affects the Multi-User-Selector AJAX Endpoint, specifically the UserselectorAdmController::getDataTask function in the /appCore/ajax.adm_server.php file. The vulnerability arises from improper handling of the 'Name' argument, allowing remote attackers to manipulate SQL queries. The vulnerability has a medium severity with a CVSS score of 6.3. The vendor has not responded to disclosure, and no patch or fix is currently available. Public exploit code has been disclosed.