Vulnerability · Published Jan 30, 2026 · Assigned by VulnCheck
CVE-2020-36998forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting
Medium 6.4
In plain English
A medium-severity cross-site scripting in E-Learning Suite from forma. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.3%top 77.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrary JavaScript without proper input sanitization.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| forma | E-Learning Suite | 0 – through 2.3.0.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References
- ExploitDB-48478 exploit
- Vendor Homepage product
- Software Download Link product
- VulnCheck Advisory: forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting third-party-advisory