Onphase Forms

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:onphase:onphase_forms:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorOnphase (97684bac-01e0-5ce1-a3a0-55ae97e18584)
ProductOnphase Forms (36edc23f-0149-5cac-b98e-93b87e93c575)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-19677 vulnerable 2026-11-03 10:17:59.759910 Authentication Bypass Leading to Server-Side Command Execution
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
Published: 2026-10-23T01:21:08.272Z
Updated: 2026-11-05T02:30:48.064Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-19678 vulnerable 2026-11-03 10:17:59.223436 Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
Published: 2026-10-23T01:23:08.631Z
Updated: 2026-11-05T02:24:21.138Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.