Verbb
Products
4- 6 CVEs
- 3 CVEs
- 2 CVEs
- 2 CVEs
Recent CVEs
13| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-52889 | cri | 0.59 | — | — | Jul 6, 2026 | ## Summary Formie Hidden fields could evaluate request-derived values as Twig during front-end form rendering. When a Hidden field used a dynamic default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value, the value was copied from the… | ||
| CVE-2020-13485 | Cri | 0.59 | 9.1 | 0.01 | May 25, 2020 | The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. | ||
| CVE-2026-45697 | Cri | 0.57 | 9.8 | 0.00 | May 29, 2026 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the… | ||
| CVE-2020-13458 | Hig | 0.57 | 8.8 | 0.00 | May 25, 2020 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action. | ||
| CVE-2026-47266 | Hig | 0.50 | — | 0.00 | May 29, 2026 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26. | ||
| CVE-2020-13868 | Med | 0.42 | 6.5 | 0.00 | Jun 5, 2020 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity. | ||
| CVE-2020-13486 | Med | 0.40 | 6.1 | 0.01 | May 25, 2020 | The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection. | ||
| CVE-2025-32427 | Med | 0.35 | 5.4 | 0.00 | Apr 11, 2025 | Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking… | ||
| CVE-2020-13870 | Med | 0.35 | 5.4 | 0.01 | Jun 5, 2020 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name. | ||
| CVE-2020-13869 | Med | 0.35 | 5.4 | 0.01 | Jun 5, 2020 | An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name. | ||
| CVE-2020-13459 | Med | 0.35 | 5.4 | 0.01 | May 25, 2020 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action. | ||
| CVE-2025-32426 | Med | 0.30 | 4.6 | 0.00 | Apr 11, 2025 | Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered… | ||
| CVE-2024-35191 | Med | 0.22 | 4.4 | 0.00 | May 20, 2024 | Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a… |
- risk 0.59cvss —epss —
## Summary Formie Hidden fields could evaluate request-derived values as Twig during front-end form rendering. When a Hidden field used a dynamic default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value, the value was copied from the…
- risk 0.59cvss 9.1epss 0.01
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
- risk 0.57cvss 9.8epss 0.00
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the…
- risk 0.57cvss 8.8epss 0.00
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.
- risk 0.50cvss —epss 0.00
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.
- risk 0.42cvss 6.5epss 0.00
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.
- risk 0.40cvss 6.1epss 0.01
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.
- risk 0.35cvss 5.4epss 0.00
Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking…
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.
- risk 0.30cvss 4.6epss 0.00
Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered…
- risk 0.22cvss 4.4epss 0.00
Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a…