CVE-2026-95808

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.49

Description An issue exists where unauthenticated attackers can perform blind SQL Injection, a technique used to extract information from a database by asking the server true or false questions. This occurs due to insufficient escaping of the inputs parameter and a lack of preparation in the SQL query. Attackers can append additional queries to extract sensitive data. The required nonce, a unique token used to prevent cross-site request forgery, is exposed on every public page that renders a form, allowing it to be easily obtained from the page source.

Recommendations Update to a version newer than 1.15.48. Avoid using the inputs parameter until the update is applied.