CVE-2014-5257: Formalms

Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the (1) id_custom parameter in an amanmenu request or (2) id_game parameter in an alms/games/edit request to appCore/index.php.

Affected products

• Formalms Formalms: up to and including 1.2.1

Published 2014-11-06. Last modified 2026-06-17.