Skip to content
OpenAdvisories

Vendor

verbb

9 known vulnerabilities.

Products

formie 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-52889

    Formie: Server-Side Template Injection in Formie Hidden field defaults

    Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rend…

    verbb formie verbb/formie Packagist
  • Critical 9.8
    CVE-2026-45697

    Formie: Pre-authenticated server-side template injection in Hidden fields

    Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious…

    verbb formie verbb/formie Packagist