Read the docs

onPhase

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

onPhase records in CISA KEV

No onPhase vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-79495 CVE-2026-19677 · GHSA-542f-hr4v-mv7f

Authentication bypass in onPhase Forms allows OS command execution

Priority MEDIUM 49

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designe…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00533 Published 2026-10-23 No fix listed CWE-306
TI-2026-79496 CVE-2026-19678 · GHSA-qgfh-wgwf-xmcx

Server-side request forgery in onPhase Forms leaks internal Solr data

Priority MEDIUM 44

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an at…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00386 Published 2026-10-23 No fix listed CWE-918
Open these records in search →