What’s Vulnerable › Vulnerabilities

CVE-2019-5111

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-03 · updated 2026-06-17
• Weakness: CWE-89

Description

Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_cat was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system.

Affected products

• Forma LMS: 2.2.1

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0904
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0904

Get alerted when CVE-2019-5111 or the next vulnerability affects your stack