CVE-2025-64515mediumCWE-20

CVE-2025-64515: fallo de gravedad media en open-formulieren open-forms

Open Forms prefill data in read-only components can be tampered

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear open-forms

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.3%
Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
open-formulieren · open-forms
CVEs relacionadas — open-formulieren open-forms

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-31041HIGHInsufficient content-type validation for uploaded files in open-formsEPSS 0.8%CVE-2022-31040HIGHOpen Redirect in open-formsEPSS 0.7%CVE-2024-24771HIGHOpen Forms potential multi-factor authentication bypassEPSS 0.6%CVE-2026-28803MEDIUMOpen Forms possible to view submission details of other people than intendedEPSS 0.2%