| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | Exploit for CVE-2026-12793 | 16 Sep 202614:43 | – | githubexploit |
| Exploit for CVE-2026-12793 | 16 Sep 202615:18 | – | githubexploit |
| Exploit for CVE-2026-12793 | 17 Sep 202602:44 | – | githubexploit |
 | CVE-2026-12793 | 16 Sep 202604:30 | – | circl |
 | CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter | 16 Sep 202603:28 | – | cvelist |
 | EUVD-2026-80097 | 16 Sep 202603:28 | – | euvd |
 | CVE-2026-12793 | 30 Sep 202620:42 | – | kitploit |
| CVE-2026-12793 | 30 Sep 202611:38 | – | kitploit |
| CVE-2026-12793 | 7 Oct 202601:13 | – | kitploit |
 | CVE-2026-12793 | 16 Sep 202604:17 | – | nvd |
10
Node
[
{
"vendor": "jetmonsters",
"product": "JetFormBuilder — Dynamic Blocks Form Builder",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "3.6.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| hook_key | request body | / | Privilege escalation: unauthenticated attacker can create an administrator-level account by sending crafted payload to the root POST endpoint using randomized router keys and a valid form id. | CWE-269 |
| hook_val | request body | / | Privilege escalation: unauthenticated attacker can create an administrator-level account by sending crafted payload to the root POST endpoint using randomized router keys and a valid form id. | CWE-269 |
| _jet_engine_booking_form_id | request body | / | Privilege escalation: unauthenticated attacker can create an administrator-level account by sending crafted payload to the root POST endpoint using randomized router keys and a valid form id. | CWE-269 |
| jet_form_builder_submit | request body | / | Privilege escalation: unauthenticated attacker can create an administrator-level account by sending crafted payload to the root POST endpoint using randomized router keys and a valid form id. | CWE-269 |
| rest_route | query param | /?rest_route=/wp/v2/posts&slug=jfb-lab-carrier | Step to obtain exploit data (post id and hidden router keys) used to trigger the vulnerability. | CWE-269 |
| slug | query param | /?rest_route=/wp/v2/posts&slug=jfb-lab-carrier | Step to obtain exploit data (post id and hidden router keys) used to trigger the vulnerability. | CWE-269 |
| rest_route | query param | /?rest_route=/wp/v2/users/<user_id> | Witness or confirm the creation of privileged users by listing users via the REST route. | CWE-269 |
| form_id | request body | /jet-form-builder/v1/validate-field | Validation endpoint mentioned in the vulnerability context; potential attack vector when misrouting or handling form_id/requests. | CWE-269 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Sep 2026 18:16Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.19.8
EPSS0.00517
SSVC