https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T11:53:49.113861+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-224600 EUVD-2026-224600 2026-10-05T11:53:49.116608+00:00 EUVD-2026-224600 https://cve.radiocsirt.org/vuln/fkie_cve-2023-24230 fkie_cve-2023-24230 2026-10-05T11:53:49.116639+00:00

A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter.

 https://cve.radiocsirt.org/vuln/ghsa-fvrh-wrpf-6q7h GHSA-fvrh-wrpf-6q7h — Formwork Cross-site Scripting (XSS) from Page title field 2026-10-05T11:53:49.116668+00:00

Affected: Packagist: getformwork/formwork

### Description A stored cross-site scripting (XSS) vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field.

Only users with access to Administration Panel with page editing permission can inject raw HTML in the Page title field.

### Patched versions This vulnerability has been patched in [Formwork 1.13.0](https://github.com/getformwork/formwork/releases/tag/1.13.0).

 https://cve.radiocsirt.org/vuln/gsd-2023-24230 gsd-2023-24230 2026-10-05T11:53:49.116695+00:00 gsd-2023-24230