Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the actionGetResendModalContent process. An attacker can access sensitive submission data, including personally identifiable information, by invoking the control panel action without the required permissions...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the formie/submissions/submit action. An attacker can overwrite or hijack another user's incomplete submission by supplying a crafted submissionId parameter without proper session binding, ownership validation,...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the formie/integrations/form-settings action in the control panel. An attacker can access and modify integration settings, potentially exfiltrating stored API keys or OAuth tokens by redirecting...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the administrative settings routes due to missing authorization checks. An attacker can modify global plugin configuration and access restricted settings by directly accessing specific control panel routes with ...

Template Injection

verbb/formie is vulnerable to Template Injection. An attacker can execute arbitrary code by including malicious Twig code into fields that support Twig, such as the Submission Title or the Success Message...