VYPR
← All advisories
High severity8.8NVD Advisory· Published Oct 8, 2020· Updated Jun 17, 2026

CVE-2020-26802

CVE-2020-26802

Description

forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the admin email address in order to accomplish an account takeover.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Forma/Formalms2 versions
    cpe:2.3:a:formalms:formalms:2.3.0.2:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:formalms:formalms:2.3.0.2:*:*:*:*:*:*:*
    • (no CPE)range: = 2.3.0.2
  • forma.lms/forma.lmsdescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.