CVE-2020-36960
Stored XSS in Forma LMS User Profile Name Fields
Publication date: 2026-01-26
Last updated on: 2026-01-26
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| forma_lms | forma_lms | to 2.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2020-36960 is a stored cross-site scripting (XSS) vulnerability in Forma LMS version 2.3 and earlier. It occurs because the application does not properly neutralize input in the user profile's first and last name fields. Attackers can inject malicious JavaScript code into these fields, such as <script>alert(document.cookie)</script>. When other users view the compromised profile, the injected script executes in their browsers, potentially allowing attackers to perform actions like session hijacking or other malicious activities. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute arbitrary JavaScript code in the browsers of users who view the compromised profiles. This can lead to session hijacking, theft of sensitive information such as cookies, and potentially other malicious actions that compromise user accounts and data integrity within the LMS environment. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the user profile first and last name fields in Forma LMS for injected scripts such as <script>alert(document.cookie)</script>. Since the exploit involves stored cross-site scripting, you can manually inspect these fields for suspicious script tags. Automated detection might involve scanning the database or web application inputs for script tags in these fields. Specific commands are not provided in the resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include sanitizing and validating user input in the first and last name fields to prevent script injection, applying any available patches or updates to Forma LMS version 2.3 or later, and restricting user privileges to limit the ability to inject scripts. Additionally, educating users to avoid viewing suspicious profiles and monitoring for unusual activity can help reduce risk. [1, 2]