Executive brief
verbb/formie Server-Side Template Injection for variable-enabled settings
Affected products
- Packagist verbb/formie
Junglewise Threat Intelligence
CVE-2024-35191: verbb/formie Server-Side Template Injection for variable-enabled settings
CVE-2024-35191 · Severity: low · CVSS 3.1 · Published 2024-05-20
Technologies: verbb/formie (Packagist). Vendors: Packagist.
Related threats
- Verbb Formie missing authorization in administrative settings
- Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
- Verbb Formie server-side template injection in Hidden fields
- Formie has XSS vulnerability for email notification content for preview
- Formie has XSS vulnerability for importing forms