VULNERABILITY INTELLIGENCE

CVE-2026-77137

EPSS probability0.40%
CISA KEVNot currently listed
Published2026-08-25
Last modified2026-09-28

Description

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.

Weakness classification

  • f4fb688c-4412-4426-b4b8-421ecf27b14a: CWE-89

Primary references