CVE-2025-9083critical

CVE-2025-9083: falha crítica em Ninja Forms

Ninja-forms < 3.11.1 - Unauthenticated PHP Objection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Forms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.6%
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · Ninja Forms
CVEs relacionadas — Ninja Forms

No mesmo produto, das mais perigosas para as menos.

CVE-2024-7354MEDIUMNinja Forms 3.8.6-3.8.10 - Reflected XSSEPSS 0.7%CVE-2026-92438HIGHNinja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions AdminEPSS 0.4%CVE-2026-91827HIGHNinja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV ExportEPSS 0.3%CVE-2025-14072MEDIUMNinja Forms < 3.13.3 - Unauthenticated Token Generation and Submission DisclosureEPSS 0.3%CVE-2025-2524MEDIUMNinja Forms < 3.10.1 - Admin+ Stored XSSEPSS 0.3%CVE-2025-2561MEDIUMNinja Forms < 3.10.1 - Admin+ Stored XSSEPSS 0.3%