{"id":"CVE-2026-82451","state":"PUBLISHED","title":"Formwork < 2.3.11 Stored XSS via Referer Header","description":"Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.","publishedAt":"2026-08-29T13:47:54.007Z","updatedAt":"2026-09-24T14:20:26.937Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["getformwork Formwork"],"affected":[{"vendor":"getformwork","product":"Formwork","packageURL":"pkg:github/getformwork/formwork","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected","lessThanOrEqual":"2.3.10","versionType":"semver"},{"version":"2.3.11","status":"unaffected","versionType":"semver"}],"collectionURL":"https://github.com/getformwork/formwork","repo":"https://github.com/getformwork/formwork"}],"references":["https://github.com/getformwork/formwork/security/advisories/GHSA-hpgc-57cm-66pc","https://github.com/getformwork/formwork/releases/tag/2.3.11","https://www.vulncheck.com/advisories/formwork-stored-xss-via-referer-header"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82451.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82451","state":"PUBLISHED","datePublished":"2026-08-29T13:47:54.007Z","dateUpdated":"2026-09-24T14:20:26.937Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-08-29T13:22:58.240Z"},"containers":{"cna":{"title":"Formwork < 2.3.11 Stored XSS via Referer Header","descriptions":[{"lang":"en","value":"Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel."}],"affected":[{"vendor":"getformwork","product":"Formwork","packageURL":"pkg:github/getformwork/formwork","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected","lessThanOrEqual":"2.3.10","versionType":"semver"},{"version":"2.3.11","status":"unaffected","versionType":"semver"}],"collectionURL":"https://github.com/getformwork/formwork","repo":"https://github.com/getformwork/formwork"}],"references":[{"url":"https://github.com/getformwork/formwork/security/advisories/GHSA-hpgc-57cm-66pc","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-hpgc-57cm-66pc)"},{"url":"https://github.com/getformwork/formwork/releases/tag/2.3.11","tags":["release-notes"],"name":"Release Notes"},{"url":"https://www.vulncheck.com/advisories/formwork-stored-xss-via-referer-header","name":"VulnCheck Advisory: Formwork through 2.3.14 Stored XSS via Referer Header","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","version":"3.1","baseSeverity":"MEDIUM","baseScore":6.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-24T14:20:26.937Z"},"datePublic":"2026-08-26T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:formwork_project:formwork:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.3.11"}]}]}],"credits":[{"lang":"en","value":"Abdurakhmon Kodirov","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-02T18:02:28.558485Z","id":"CVE-2026-82451","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-02T18:02:37.197Z"}}]}}}