Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL.
Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon codes.
CVSS 4.0MEDIUM 6.3·Network·No auth·No interaction·EPSS 0.00402·Published 2025-05-26·Fixed in 4.3.4CWE-209
THREATIST.IORead the docs