https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T14:08:55.419807+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54721 CVE-2026-54721 — Silverstripe UserForms: Remote code execution via userforms email subject 2026-10-09T14:08:55.437348+00:00

Affected: silverstripe-userforms

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.