CVE-2025-32427

Katalog CVE

CVSS 5.4 · Medium EPSS 0,23%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada verbb formie. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export. This vulnerability is fixed in 2.1.44.

Rincian

Terbit di NVD

11 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/verbb/formie/security/advisories/GHSA-p9hh-mh5x-wvx3 advisory vendor