onPhase Forms vulnerabilities

2 known vulnerabilities in onPhase Forms from onPhase. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  onPhase Forms: Server-Side Request Forgery

  CVE-2026-19678Oct 23, 2026onPhase

  A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publ

• 9.3 Critical severity

  onPhase Forms: Missing Authentication for Critical Functionality

  CVE-2026-19677Oct 23, 2026onPhase

  An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary oper