PT-2026-86419
CVE-2026-86194
·
تاريخ النشر
2026-09-05
·
تاريخ التحديث
2026-09-18
الوصف من
CVSS 4.0
6.9
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Grav Form Plugin versions prior to 9.1.22
Description
Insufficient page authorization verification occurs when resolving forms by name across pages. This allows anonymous visitors to execute form actions—such as saving, uploading, emailing, or calling—defined on unpublished or login-restricted pages. An attacker can trigger these actions by sending a POST request to any public page using the name of a restricted form.
Recommendations
Update Grav Form Plugin to version 9.1.22 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾