CVE-2022-41681

8.8 highEPSS 1.0%

High (8.8) in formalms formalms. EPSS 1.0% chance of exploitation in the next 30 days.

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability could lead to a remote code injection.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2022-10-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

formalms:formalms

References

https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-forma-lms
https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-forma-lms

Check your stack JSON