CyberSecBulletin

onPhase vulnerabilities

We track 2 vulnerabilities in onPhase products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.

2vulnerabilities
1critical
1high
0exploited
9.0average CVSS score

Latest onPhase vulnerabilities

  • 8.7 High severity

    onPhase Forms: Server-Side Request Forgery

    CVE-2026-19678onPhase

    A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publ

  • 9.3 Critical severity

    onPhase Forms: Missing Authentication for Critical Functionality

    CVE-2026-19677onPhase

    An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary oper