Server-Side Request Forgery in onPhase Forms by Frevvo

CVE-2026-19678

What is CVE-2026-19678?

A vulnerability exists in onPhase Forms, specifically in version 11.0.14, which permits server-side request forgery (SSRF). This weakness enables an unauthorized remote attacker to exploit an unauthenticated form service. By manipulating the input to a publicly accessible form, the attacker can make requests to internal systems, allowing them to access sensitive data stored within Apache Solr. Such an exploit highlights the importance of secure form handling and authentication mechanisms to safeguard internal resources.

References