Forma LMS CVE-2026-96777

Exploitation requires an authenticated session with access to the Forma LMS administrative back end (the vector is PR:L and the vulnerable path /appCore/ajax.adm_server.php?r=adm/userselector/getData is an admin-scoped AJAX endpoint). No user interaction is needed and the attack is fully remote over the network against the default application (no non-default configuration is called out in the advisory). The primary limiting factor is the need for valid low-privileged/admin-panel credentials; there is no unauthenticated path, and the product's limited deployment base further constrains exposure. Affected versions are all releases up to and including 4.1.43, with no vendor-supplied fix currently available.

This is a moderate, not top-tier, priority. The only quantitative signal is a vendor/VulDB-assigned CVSS 4.0 base of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) with Exploit-maturity E:P (proof-of-concept). There is no EPSS score and no CISA KEV listing in the input, so there is no evidence of active or widespread exploitation - the status is publicly available exploit code exists, which is a distinct and weaker signal than in-the-wild use. The network attack vector and low complexity make the flaw easy to trigger, but PR:L means the attacker must already be an authenticated user, and the endpoint (/appCore/ajax.adm_server.php?r=adm/userselector/getData) is an administrative AJAX handler, further narrowing the realistic attacker population. I disagree with VulDB's uniformly Low impact rating: a classic CWE-89 SQL injection typically permits full database read (and often write), so confidentiality impact is likely High rather than Low; VulDB appears to lowball SQLi impact as it does for similar rolling-release advisories. Net: a genuine, POC-backed SQLi worth patching, but the authentication requirement and niche product footprint keep real-world risk in the medium band rather than critical.

An authenticated user with access to the Forma LMS administrative interface sends a crafted request to the Multi-User-Selector AJAX endpoint with a malicious 'Name' parameter, injecting SQL into the getDataTask query to extract user records, credentials, or other database contents. Because the manipulation is remote and low-complexity, and a proof-of-concept advisory is publicly published on GitHub (lorenzobruno7/advisory_formalms), reliable exploitation is straightforward for anyone with a valid account.