CVE-2020-36998

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in course code, name, description fields, and email parameter to execute arbitrary JavaScript without proper input sanitization.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 30, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2020

CVE-2020-369998.2Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipulating the login pageCVE-2020-37007.5Possible out of bounds read due to a missing bounds check and could lead to local information disclosure in the wifi driver with no additionCVE-2020-370009.8Free MP3 CD Ripper 2.8 contains a stack buffer overflow vulnerability that allows remote attackers to execute arbitrary code by crafting a mCVE-2020-370018.4Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the Pack File feature that allows attackers to execute arbitCVE-2020-370029.8Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commandCVE-2020-370036.4Sellacious eCommerce 4.6 contains a persistent cross-site scripting vulnerability in the Manage Your Addresses module that allows attackers CVE-2020-370048.2The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames aCVE-2020-370057.1TimeClock Software 1.01 contains an authenticated time-based SQL injection vulnerability that allows attackers to enumerate valid usernames CVE-2020-370068.2berliCRM 1.0.24 contains a SQL injection vulnerability in the 'src_record' parameter that allows remote attackers to manipulate database queCVE-2020-370074.3Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper requeCVE-2020-370087.5EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to aCVE-2020-370098.8MedDream PACS Server 6.8.3.751 contains an authenticated remote code execution vulnerability that allows authorized users to upload maliciou
CVE-2020-36998: Medium severity, CVSS 6.4 | Vulnix