PT-2025-40005 · Formcms · Formcms

Kkc73 · Published 2025-09-30 · Updated 2025-12-23 · CVE-2025-55797

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FormCms version 0.5.4

Description An access control issue exists in FormCms version 0.5.4. An unauthenticated attacker can access historical schema data via the /api/schemas/history/[schemaId] API endpoint if a valid schemaId is known or guessed.

Recommendations Apply a fix for FormCms version 0.5.4 to address the improper access control.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2025-55797

GHSA-6CWX-42HW-W69C

Affected Products

Formcms

References · 15

• 🔥 https://github.com/KKC73/me/tree/main/CVE-2025-55797 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55797 · Security Note
• https://osv.dev/vulnerability/GHSA-6cwx-42hw-w69c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55797 · Vendor Advisory
• https://github.com/FormCms/FormCms · Note
• https://github.com/formcms/formcms/issues/19 · Note
• https://github.com/FormCms · Note
• https://reddit.com/r/VulnMatter/comments/1o30vje/resumen_diario_de_vulnerabilidades_10102025 · Reddit Post
• https://t.me/CVEtracker/33738 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o120p5/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://t.me/cveNotify/137641 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o1aw7v/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1973151066788188272 · Twitter Post
• https://twitter.com/CVEnew/status/2003567321248362785 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o28ww8/resumen_diario_de_vulnerabilidades_09102025 · Reddit Post