getformwork

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

getformwork records in CISA KEV

No getformwork vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Formwork 4 records MEDIUM

Records

7 records

TI-2025-40524 CVE-2025-65956 · GHSA-7j46-f57w-76pj

Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags

MEDIUM 62

Formwork is a flat file-based Content Management System (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00218 Published 2025-11-25 Fixed in 2.2.0 CWE-79

TI-2023-09940 CVE-2023-24230 · GHSA-fvrh-wrpf-6q7h

A stored cross-site scripting (XSS) vulnerability in the component…

MEDIUM 55

A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page titl…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00544 Published 2023-02-10 Fixed in 1.13.0 CWE-79

TI-2026-21635 CVE-2026-27198 · GHSA-34p4-7w83-35g2

Formwork Improperly Manages Privileges During User Creation

MEDIUM 40

Formwork is a flat file-based Content Management System (CMS).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00458 Published 2026-02-21 Fixed in 2.3.4 CWE-269

TI-2026-67389 CVE-2026-104478 · GHSA-4v26-phwj-4v5r

Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

LOW 31

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00352 Published 2026-10-02 Fixed in 2.3.13 CWE-22

TI-2026-56848 CVE-2026-82451 · GHSA-3p45-hx6j-c7f5

Formwork < 2.3.11 Stored XSS via Referer Header

LOW 24

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00356 Published 2026-08-29 Fixed in 2.3.11 CWE-79

TI-2026-68481 CVE-2026-105950 · GHSA-3j63-cg5x-w8f2

Cross-site scripting in getformwork Formwork URI sanitizer

LOW 23

A security vulnerability has been detected in getformwork formwork up to 2.3.12.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00288 Published 2026-10-06 Fixed in 2.3.13 CWE-79

TI-2024-24687 CVE-2024-37160 · GHSA-5pxr-7m4j-jjc6

Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata

LOW 22

Formwork is a flat file-based Content Management System (CMS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00463 Published 2024-06-07 Fixed in 1.13.1, 2.0.0-beta.2 CWE-79

Open these records in search →

Critical	0
High	2
Medium	5
Low	0
No CVSS	0