CVE-2024-35191

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1336

Affected software

Vendor	Product	Versions
verbb	formie	< 2.1.6
verbb	formie	< 2.1.6

References

Timeline

Published: May 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-351925.5Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted maliciou CVE-2024-351945.3Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memor CVE-2024-351955.6Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=Fa CVE-2024-351962.0Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming CVE-2024-351975.4gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and che CVE-2024-351989.8TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls conf CVE-2024-351998.2TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports CVE-2024-35204.3The Country State City Dropdown CF7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec CVE-2024-352005.3When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to t CVE-2024-352017.8Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalatio CVE-2024-352027.5Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by includi CVE-2024-352036.1Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part of its name, that is