Formwork
Monthly
Formwork CMS versions 2.0.0 through 2.3.3 fail to validate user privileges during account creation, allowing authenticated editors to create admin accounts and gain full CMS control. An attacker with editor-level access can exploit this authorization bypass to escalate privileges without restriction, completely compromising the application. A patch is available in version 2.3.4.
Stored cross-site scripting in the Formwork PHP content management system (versions up to and including 2.3.12) lets an authenticated user who can submit HTML content inject a script-bearing 'formaction' URI that survives the built-in DomSanitizer. The payload does not fire on its own: a second user must view and activate the injected form control (UI:P/UI:R) for the script to execute, which is why this is rated medium severity (CVSS 4.0 base 5.1; independently assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The flaw is fixed in Formwork 2.3.13, and no public exploit code has been identified at time of analysis.
Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. When an administrator opens the Statistics panel, the injected payload executes in their browser, enabling session hijacking, credential theft, or further compromise of the admin interface. No public exploit code or CISA KEV listing is identified at time of analysis.
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Formwork CMS versions 2.0.0 through 2.3.3 fail to validate user privileges during account creation, allowing authenticated editors to create admin accounts and gain full CMS control. An attacker with editor-level access can exploit this authorization bypass to escalate privileges without restriction, completely compromising the application. A patch is available in version 2.3.4.
Stored cross-site scripting in the Formwork PHP content management system (versions up to and including 2.3.12) lets an authenticated user who can submit HTML content inject a script-bearing 'formaction' URI that survives the built-in DomSanitizer. The payload does not fire on its own: a second user must view and activate the injected form control (UI:P/UI:R) for the script to execute, which is why this is rated medium severity (CVSS 4.0 base 5.1; independently assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The flaw is fixed in Formwork 2.3.13, and no public exploit code has been identified at time of analysis.
Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. When an administrator opens the Statistics panel, the injected payload executes in their browser, enabling session hijacking, credential theft, or further compromise of the admin interface. No public exploit code or CISA KEV listing is identified at time of analysis.
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.