WE
Vendor
WebRehab
8
CVEs
0
On KEV
6
New 30D
Products
SF9.8
Super Forms – Drag & Drop Form Builder
WebRehab
7 CVEs0 on KEV6 new
SF7.5
Super Forms
WebRehab
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-17609 | SF Super Forms – Drag & Drop Form Builder WebRehab | 9.1 | Oct 8 | Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter |
| CVE-2026-17196 | SF Super Forms – Drag & Drop Form Builder WebRehab | 8.8 | Oct 8 | Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute |
| CVE-2026-15896 | SF Super Forms – Drag & Drop Form Builder WebRehab | 9.1 | Oct 2 | Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter |
| CVE-2026-15897 | SF Super Forms – Drag & Drop Form Builder WebRehab | 8.8 | Oct 2 | Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login |
| CVE-2026-15983 | SF Super Forms – Drag & Drop Form Builder WebRehab | 8.1 | Oct 1 | Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter |
| CVE-2026-15989 | SF Super Forms – Drag & Drop Form Builder WebRehab | 9.8 | Oct 1 | Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter |
| CVE-2026-28167 | SF Super Forms WebRehab | 7.5 | Aug 24 | WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability |
| CVE-2026-14894 | SF Super Forms – Drag & Drop Form Builder WebRehab | 9.8 | Jul 10 | Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) |