CVE-2026-71435

Publié : 6 août 2026

Modifié : 6 août 2026

Score CVSS

6.1

MEDIUM

Description détaillée

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Références et Patchs

https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c https://github.com/statamic/cms/pull/14959 https://github.com/statamic/cms/releases/tag/v5.74.3 https://github.com/statamic/cms/releases/tag/v6.24.2 https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc

Dernières Vulnérabilités

CVE-2026-70332

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

VOIR DÉTAILS

CVE-2026-68823

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.

VOIR DÉTAILS

CVE-2026-65668

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.

VOIR DÉTAILS