What’s Vulnerable › Products

WebRehab Super Forms – Drag & Drop Form Builder vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your WebRehab Super Forms – Drag & Drop Form Builder version is affected

Latest WebRehab Super Forms – Drag & Drop Form Builder vulnerabilities

• CVE-2026-17609 — Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter (CVSS 9.1)
• CVE-2026-17196 — Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute (CVSS 8.8)
• CVE-2026-15897 — Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login (CVSS 8.8)
• CVE-2026-15896 — Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter (CVSS 9.1)
• CVE-2026-15983 — Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter (CVSS 8.1)
• CVE-2026-15989 — Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter (CVSS 9.8)
• CVE-2026-14894 — Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) (CVSS 9.8)