SQL Injection Vulnerability in Forma LMS Multi-User-Selector by Forma
CVE-2026-96777

5.3MEDIUM

Key Information:

Vendor: Forma
Status: Lms
Vendor: CVE Published:; 24 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-96777?

A security flaw exists in Forma LMS versions up to 4.1.43, specifically within the Multi-User-Selector AJAX Endpoint. The vulnerability is triggered through the UserselectorAdmController::getDataTask function found in the /appCore/ajax.adm_server.php file. Malicious users can exploit this flaw by manipulating the 'Name' argument, leading to potential SQL injection attacks. These attacks can be executed remotely, thus posing a significant risk to affected systems. Despite early notifications, the vendor has not provided any response or patch for this issue, leaving users exposed to possible exploitation.

Affected Version(s)

LMS 4.1.0

LMS 4.1.1

LMS 4.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-96777 - Proof of Concept