CVE-2026-19678

HighCVSS 8.7/10Last modified Oct 23, 2026

Description

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-196798.8An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames co CVE-2026-196807.1A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's data CVE-2026-196819.9An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this CVE-2026-196829.9A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arb CVE-2026-196837.4A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS servi CVE-2026-196857.1NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. T CVE-2026-19695.3The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated use CVE-2026-196938.1extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component,CVE-2026-196945.5TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service CVE-2026-196955.5Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service CVE-2026-196965.5Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows CVE-2026-196976.8The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with