Skip to content
OpenAdvisories

Vendor

endatix

1 known vulnerabilities.

Products

endatix 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.7
    CVE-2026-61529

    Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

    Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-controlled `JsonData` after checking only that the JSON is well formed. A file object w…

    endatix endatix