PT-2026-36993 · 10Web · Form Maker

Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-3359

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder versions prior to 1.15.43

Description Insufficient escaping of user-supplied parameters and a lack of proper preparation in SQL queries allow unauthenticated attackers to perform SQL Injection. By appending additional SQL queries via the inputs parameter, an attacker can extract sensitive information from the database.

Recommendations Update to a version later than 1.15.42. As a temporary workaround, restrict access to or avoid using the inputs parameter until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3359

Affected Products

Form Maker

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3359 · Security Note
• https://twitter.com/infoflowcloud/status/2051596852873588924 · Twitter Post
• https://twitter.com/CVEnew/status/2051595415162847352 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3518461/form-maker · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f37cc880-d8a4-431a-9639-abf01163030a?source=cve · Note