Super Forms – Drag & Drop Form Builder vulnerabilities

Product

Super Forms – Drag & Drop Form Builder

by WebRehab · last CVE Oct 8, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 4High 3Medium 0Low 0

Severity

Exploitation

Watch

Add Super Forms – Drag & Drop Form Builder to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-15989	9.8	0%	Oct 1	Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter Affected: through 6.3.316
CVE-2026-14894	9.8	3%	Jul 10	Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) Affected: through 6.3.313
CVE-2026-17609	9.1	0%	Oct 8	Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter Affected: through 6.3.316
CVE-2026-15896	9.1	1%	Oct 2	Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter Affected: through 6.3.316
CVE-2026-17196	8.8	1%	Oct 8	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute Affected: through 6.3.316
CVE-2026-15897	8.8	0%	Oct 2	Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login Affected: through 6.3.316
CVE-2026-15983	8.1	1%	Oct 1	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter Affected: through 6.3.316