CVE-2026-105950

Published: Ott 06, 2026 Last Modified: Ott 06, 2026

ExploitDB:

Other exploit source:

Google Dorks:

MEDIUM 5,1

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: passive

Confidentiality: N/A

Integrity: N/A

Availability: N/A

LOW 3,5

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: required

Scope: unchanged

Confidentiality: none

Integrity: low

Availability: none

MEDIUM 4,0

Source: [email protected]

Access Vector: network

Access Complexity: low

Authentication: single

Confidentiality: none

Integrity: partial

Availability: none

Description

AI Translation Available

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.