WebRehab vulnerabilities

Newest CVEs

• CVE-2026-17609

  Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

  WebRehab · Super Forms – Drag & Drop Form Builder

  Critical9.1
• CVE-2026-17196

  Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute

  WebRehab · Super Forms – Drag & Drop Form Builder

  High8.8
• CVE-2026-15896

  Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

  WebRehab · Super Forms – Drag & Drop Form Builder

  Critical9.1
• CVE-2026-15897

  Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login

  WebRehab · Super Forms – Drag & Drop Form Builder

  High8.8
• CVE-2026-15983

  Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

  WebRehab · Super Forms – Drag & Drop Form Builder

  High8.1
• CVE-2026-15989

  Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

  WebRehab · Super Forms – Drag & Drop Form Builder

  Critical9.8
• CVE-2026-28167

  WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability

  WebRehab · Super Forms

  High7.5
• CVE-2026-14894

  Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

  WebRehab · Super Forms – Drag & Drop Form Builder

  Critical9.8