https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:43:04 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54721 <p>Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.</p> <p>Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54721 https://vulnerability.circl.lu/vuln/ghsa-g8wr-r2v2-vqc6 <p><strong>Affected:</strong> Packagist: silverstripe/userforms</p> <p>### Impact The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server.</p> <p>### Reported by Jack Wallace from Bastion Security</p> <p><strong>Affected:</strong> Packagist: silverstripe/userforms</p> <p>### Impact The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server.</p> <p>### Reported by Jack Wallace from Bastion Security</p> https://vulnerability.circl.lu/vuln/ghsa-g8wr-r2v2-vqc6