TI-2026-68481 CVE-2026-105950 · GHSA-3j63-cg5x-w8f2
Cross-site scripting in getformwork Formwork URI sanitizer
Priority LOW 23
A security vulnerability has been detected in getformwork formwork up to 2.3.12.
Vulnerabilities
7 records
TI-2026-67389 CVE-2026-104478 · GHSA-4v26-phwj-4v5r
Formwork before 2.3.13 Path Traversal via BackupController Download and Delete
Priority LOW 31
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files.
TI-2026-56848 CVE-2026-82451 · GHSA-3p45-hx6j-c7f5
Formwork < 2.3.11 Stored XSS via Referer Header
Priority LOW 24
Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped.
TI-2026-21635 CVE-2026-27198 · GHSA-34p4-7w83-35g2
Formwork Improperly Manages Privileges During User Creation
Priority MEDIUM 40
Formwork is a flat file-based Content Management System (CMS).
TI-2025-40524 CVE-2025-65956 · GHSA-7j46-f57w-76pj
Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags
Priority MEDIUM 62
Formwork is a flat file-based Content Management System (CMS).
TI-2024-24687 CVE-2024-37160 · GHSA-5pxr-7m4j-jjc6
Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata
Priority LOW 22
Formwork is a flat file-based Content Management System (CMS).
TI-2023-09940 CVE-2023-24230 · GHSA-fvrh-wrpf-6q7h
A stored cross-site scripting (XSS) vulnerability in the component…
Priority MEDIUM 55
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page titl…