CVE-2021-43136

EPSS 15.7%

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 15.7%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

10 Nov 2021Published on NVD

11 Nov 2021Public PoC

Weaponization speed

1 daysto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/164930/FormaLMS-2.4.4-Authentication-Bypass.htmlunverified exploitdbwww.exploit-db.com/exploits/50513unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/164930/FormaLMS-2.4.4-Authentication-Bypass.html https://blog.hacktivesecurity.com https://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass/https://formalms.org