' to execute arbitrary JavaScript when the profile is viewed by ","inLanguage":"en-US","identifier":"CVE-2020-36960","datePublished":"2026-01-26T18:16:27.020","dateModified":"2026-06-17T03:16:37.097","about":{"@type":"Thing","name":"CVE-2020-36960","identifier":"CVE-2020-36960"},"isPartOf":{"@type":"WebSite","name":"GotRooted","url":"https://gotrooted.org/"},"publisher":{"@type":"Organization","name":"GotRooted","logo":{"@type":"ImageObject","url":"https://gotrooted.org/logo.png","width":640,"height":640}}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://gotrooted.org/"},{"@type":"ListItem","position":2,"name":"cve","item":"https://gotrooted.org/cve"},{"@type":"ListItem","position":3,"name":"CVE 2020 36960","item":"https://gotrooted.org/cve/CVE-2020-36960"}]}]}

VULNERABILITY INTELLIGENCE

CVE-2020-36960

CVSS score6.4 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-01-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Description

Forma LMS 2.3 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into user profile first and last name fields. Attackers can craft scripts like '<script>alert(document.cookie)</script>' to execute arbitrary JavaScript when the profile is viewed by other users.

Weakness classification

  • disclosure@vulncheck.com: CWE-79

Primary references