Known vulnerabilities in Webform

Vendor: quicksketch
Software: Webform
Software CPE: cpe:2.3:a:quicksketch:webform:*:*:*:*:*:drupal:*:*
Website: https://www.drupal.org/u/quicksketch
Total vulnerabilities: 20
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Webform Webform is affected by 20 known vulnerabilities: 1 high, 7 medium, 12 low Critical High Medium Low

Vulnerabilities (20)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU152221 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-96355		 CWE-94 High
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU152220 - Improper Access Control
CVE-2026-96356		 CWE-284 Medium
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU152219 - Improper Access Control
CVE-2026-96398		 CWE-284 Medium
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU152218 - Improper Access Control
CVE-2026-96364		 CWE-284 Medium
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU152217 - Improper input validation
CVE-2026-96365		 CWE-20 Medium
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU152216 - Improper Access Control
CVE-2026-96366		 CWE-284 Medium
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU152215 - Improper Access Control
CVE-2026-96373		 CWE-284 Low
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU152214 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96357		 CWE-79 Low
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU152211 - Improper Access Control
CVE-2026-96372		 CWE-284 Medium
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU152203 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96371		 CWE-79 Low
No
No
 6.2.12, 6.3.1 25.09.2026 SB2026092450
#VU151928 - Use of Cache Containing Sensitive Information
CVE-2026-96369		 CWE-524 Low
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450
#VU151921 - Server-Side Request Forgery (SSRF)
CVE-2026-96370		 CWE-918 Medium
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450
#VU151920 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96368		 CWE-79 Low
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450
#VU151919 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96367		 CWE-79 Low
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450
#VU151918 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96363		 CWE-79 Low
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450
#VU151917 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96362		 CWE-79 Low
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450
#VU151916 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96359		 CWE-79 Low
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450
#VU151915 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96358		 CWE-79 Low
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450
#VU151914 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96361		 CWE-79 Low
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450
#VU151913 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-96360		 CWE-79 Low
No
No
 6.2.12, 6.3.1 24.09.2026 SB2026092450