Advisories · Technology
WebRehab Super Forms – Drag & Drop Form Builder.
Every CVE that names WebRehab Super Forms – Drag & Drop Form Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
- WebRehab Super Forms – Drag & Drop Form Builder
- Unrestricted file upload
- CVSS 8.8 High
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
- WebRehab Super Forms – Drag & Drop Form Builder
- Unrestricted file upload
- CVSS 9.1 CriticalCritical · CVSS 9+
Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
- WebRehab Super Forms – Drag & Drop Form Builder
- CWE-26
- CVSS 8.8 High
Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
- WebRehab Super Forms – Drag & Drop Form Builder
- Privilege escalation
- CVSS 8.1 High
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
- WebRehab Super Forms – Drag & Drop Form Builder
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
- WebRehab Super Forms – Drag & Drop Form Builder
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
- WebRehab Super Forms – Drag & Drop Form Builder
- Unrestricted file upload