CVE-2025-64515mediumCWE-20

CVE-2025-64515: falha de média gravidade em open-formulieren open-forms

Open Forms prefill data in read-only components can be tampered

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar open-forms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.3%
Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
open-formulieren · open-forms
CVEs relacionadas — open-formulieren open-forms

No mesmo produto, das mais perigosas para as menos.

CVE-2022-31041HIGHInsufficient content-type validation for uploaded files in open-formsEPSS 0.8%CVE-2022-31040HIGHOpen Redirect in open-formsEPSS 0.7%CVE-2024-24771HIGHOpen Forms potential multi-factor authentication bypassEPSS 0.6%CVE-2026-28803MEDIUMOpen Forms possible to view submission details of other people than intendedEPSS 0.2%