CVE-2022-0140: falha em Visual Form Builder
Visual Form Builder < 3.0.6 - Unauthenticated Information Disclosure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendepss 3.8%
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
Produtos afetados
Unknown · Visual Form BuilderCVEs relacionadas — Visual Form Builder
No mesmo produto, das mais perigosas para as menos.
CVE-2022-0142—Visual Form Builder < 3.0.6 - CSV InjectionEPSS 2.9%CVE-2021-24514—Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-1046—Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0141—Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRFEPSS 0.5%CVE-2026-105974MEDIUMVisual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetEPSS 0.2%CVE-2026-105973MEDIUMVisual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing AuthorizationEPSS 0.2%