CVE-2026-105950

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

CVE-2026-105950 getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

CVE-2026-105950 getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

CVE-2026-105950 getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

CVE-2026-105950

The getformwork formwork component, in versions up to 2.3.12 , is vulnerable to cross-site scripting (XSS) due to an issue in the URI Sanitizer component. Specifically, the DomSanitizer::sanitizeNodeAttribute function located in formwork/src/Sanitizer/DomSanitizer.php fails to properly handle the...

EUVD-2026-93467

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

PT-2026-106769

Name of the Vulnerable Software and Affected Versions getformwork formwork versions prior to 2.3.13 Description Remote cross site scripting is possible through the URI Sanitizer component. The issue exists in the DomSanitizer::sanitizeNodeAttribute function within the file...

CVE-2026-105950: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

Incorrect Privilege Assignment

Overview getformwork/formwork is an a file-based Content Management System CMS to make and manage simple sites. Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to insufficient privilege checks in the create user function. An attacker can gain unauthorized...

Stored Cross-site Scripting (XSS)

getformwork/formwork is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization of input in the blog tag field, which allows an attacker to inject malicious scripts that execute in the browser of any authenticated user accessing or editing the affected blo...

Cross-site Scripting (XSS)

Overview getformwork/formwork is an a file-based Content Management System CMS to make and manage simple sites. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the title field in the panel/options/site page. An attacker can exploit this vulnerability by embedding...

Cross Site Scripting (XSS)

getformwork/formwork is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper user input validation within meta.php, which allows an attacker to perform XSS...

Cross-site Scripting (XSS)

getformwork/formwork is vulnerable to Cross-site Scripting XSS. The vulnerability is caused due to insufficient sanitization of markdown fields, allowing users with page editing permissions to insert...