Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: onPhase Clear all filters
TI-2026-79496 CVE-2026-19678 · GHSA-qgfh-wgwf-xmcx

Server-side request forgery in onPhase Forms leaks internal Solr data

Priority MEDIUM 44

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an at…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00386 Published 2026-10-23 No fix listed CWE-918
TI-2026-79495 CVE-2026-19677 · GHSA-542f-hr4v-mv7f

Authentication bypass in onPhase Forms allows OS command execution

Priority MEDIUM 49

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designe…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00533 Published 2026-10-23 No fix listed CWE-306