Formwork
Monthly
Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. When an administrator opens the Statistics panel, the injected payload executes in their browser, enabling session hijacking, credential theft, or further compromise of the admin interface. No public exploit code or CISA KEV listing is identified at time of analysis.
Formwork CMS versions 2.0.0 through 2.3.3 fail to validate user privileges during account creation, allowing authenticated editors to create admin accounts and gain full CMS control. An attacker with editor-level access can exploit this authorization bypass to escalate privileges without restriction, completely compromising the application. A patch is available in version 2.3.4.
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. When an administrator opens the Statistics panel, the injected payload executes in their browser, enabling session hijacking, credential theft, or further compromise of the admin interface. No public exploit code or CISA KEV listing is identified at time of analysis.
Formwork CMS versions 2.0.0 through 2.3.3 fail to validate user privileges during account creation, allowing authenticated editors to create admin accounts and gain full CMS control. An attacker with editor-level access can exploit this authorization bypass to escalate privileges without restriction, completely compromising the application. A patch is available in version 2.3.4.
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.