verbb

Records16All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

verbb records in CISA KEV

No verbb vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Comments 3 records LOW Formie 3 records LOW Image Resizer 2 records LOW Knock Knock 2 records MEDIUM

Records

16 records

TI-2026-37985 CVE-2026-52889 · GHSA-565m-g33j-jq96

Formie: Server-Side Template Injection in Formie Hidden field defaults

MEDIUM 51

Formie is a Craft CMS plugin for creating forms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01274 Published 2026-08-19 Fixed in 3.1.27 CWE-1336

TI-2026-33438 CVE-2026-45697 · GHSA-x7m9-mwc2-g6w2

Formie: Pre-authenticated server-side template injection in Hidden fields

MEDIUM 49

Formie is a Craft CMS plugin for creating forms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00475 Published 2026-05-29 Fixed in 2.2.20, 3.1.24 CWE-1336

TI-2026-34846 CVE-2026-47266 · GHSA-pgxq-p76c-x9cg

Formie: Unauthenticated front-end submission editing can overwrite existing submissions

MEDIUM 43

Formie is a Craft CMS plugin for creating forms.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00312 Published 2026-05-29 Fixed in 2.2.21, 3.1.26 CWE-639

TI-2026-53255 CVE-2026-76087 · GHSA-584p-f93j-wpgc

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

MEDIUM 42

Formie is a Craft CMS plugin for creating forms.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00409 Published 2026-09-23 Fixed in 2.2.23, 3.1.31 CWE-639

TI-2020-10575 CVE-2020-13485 · GHSA-wxvr-qqm7-6h65

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.

MEDIUM 42

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01355 Published 2020-05-25 Fixed in 1.2.8 CWE-697

TI-2020-10552 CVE-2020-13458 · GHSA-5v5q-3m7m-97j7

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS.

LOW 39

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00484 Published 2020-05-25 Fixed in 2.0.9 CWE-352

TI-2026-53254 CVE-2026-76086 · GHSA-v3f3-cmj4-cvj9

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

LOW 37

Formie is a Craft CMS plugin for creating forms.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.0051 Published 2026-09-23 Fixed in 2.2.23, 3.1.31 CWE-862

TI-2026-53256 CVE-2026-76089 · GHSA-9rg8-2wvr-fgjh

Formie: Missing authorization on sent notification resend modal exposes submission PII

LOW 34

Formie is a Craft CMS plugin for creating forms.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-23 Fixed in 2.2.23, 3.1.31 CWE-200

TI-2020-10852 CVE-2020-13868 · GHSA-4r8c-pj7x-m5jx

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS.

LOW 29

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00428 Published 2020-06-05 Fixed in 1.5.5 CWE-352

TI-2020-10576 CVE-2020-13486 · GHSA-m69r-4h68-xq7j

The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.

LOW 28

The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0068 Published 2020-05-25 Fixed in 1.2.8 CWE-601

TI-2020-10854 CVE-2020-13870 · GHSA-69ww-wv3j-mhg4

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS.

LOW 25

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0054 Published 2020-06-05 Fixed in 1.5.5 CWE-79

TI-2020-10853 CVE-2020-13869 · GHSA-jhhf-c849-3rh2

An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS.

LOW 25

An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0054 Published 2020-06-05 Fixed in 1.5.5 CWE-79

TI-2020-10553 CVE-2020-13459 · GHSA-p7rm-gh9g-5fr8

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS.

LOW 25

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0054 Published 2020-05-25 Fixed in 2.0.9 CWE-79

TI-2025-23498 CVE-2025-32427 · GHSA-p9hh-mh5x-wvx3

Formie has a XSS vulnerability for importing forms

LOW 24

Formie is a Craft CMS plugin for creating forms.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00239 Published 2025-04-11 Fixed in 2.1.44 CWE-79

TI-2025-23497 CVE-2025-32426 · GHSA-2xm2-23ff-p8ww

Formie has a XSS vulnerability for email notification content for preview

LOW 24

Formie is a Craft CMS plugin for creating forms.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00236 Published 2025-04-11 Fixed in 2.1.44 CWE-79

TI-2024-23264 CVE-2024-35191 · GHSA-v45m-hxqp-fwf5

verbb/formie Server-Side Template Injection for variable-enabled settings

LOW 20

Formie is a Craft CMS plugin for creating forms.

CVSS 3.1MEDIUM 4.4 Local High privileges No interaction EPSS 0.00253 Published 2024-05-20 Fixed in 2.1.6 CWE-1336

Open these records in search →

Critical	3
High	5
Medium	8
Low	0
No CVSS	0