verbb/formie vulnerabilities (Packagist)

10 vulnerabilities.

• verbb/formie Packagist Formie: Unauthenticated users can overwrite incomplete submissions via submit action CVE-2026-76087 Fix available 8.2 HighSeptember 23, 2026
• verbb/formie Packagist Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials CVE-2026-76086 Fix available 8.5 HighSeptember 23, 2026
• verbb/formie Packagist Formie: Missing authorization on sent notification resend modal exposes submission PII CVE-2026-76089 Fix available 7.7 HighSeptember 23, 2026
• verbb/formie Packagist Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration GHSA-cvpc-hccg-wmw4 Fix available 6.3 MediumJuly 17, 2026
• verbb/formie Packagist Formie: Server-Side Template Injection in Formie Hidden field defaults CVE-2026-52889 Fix available 9.8 CriticalJuly 6, 2026
• verbb/formie Packagist Formie: Unauthenticated front-end submission editing can overwrite existing submissions CVE-2026-47266 Fix available 8.7 HighMay 29, 2026
• verbb/formie Packagist Formie: Pre-authenticated server-side template injection in Hidden fields CVE-2026-45697 Fix available 9.8 CriticalMay 18, 2026
• verbb/formie Packagist Formie has a XSS vulnerability for email notification content for preview CVE-2025-32426 Fix available 4.6 MediumApril 11, 2025
• verbb/formie Packagist Formie has a XSS vulnerability for importing forms CVE-2025-32427 Fix available 5.3 MediumApril 11, 2025
• verbb/formie Packagist verbb/formie Server-Side Template Injection for variable-enabled settings CVE-2024-35191 Fix available 4.4 MediumMay 20, 2024