Back to the CVE list

CVE-2026-15897

Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login

CVSS score

8.8

EPSS probability

%0.3

Risk score

0.0

Published

17 d ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

9.1

CVE-2026-15896Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

VendorWebRehab ProductSuper Forms – Drag & Drop Form Builder

Patch status unknownEPSS %117 d ago

8.8

CVE-2026-17196Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute

VendorWebRehab ProductSuper Forms – Drag & Drop Form Builder

Patch status unknownEPSS %111 d ago

8.1

CVE-2026-15983Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

VendorWebRehab ProductSuper Forms – Drag & Drop Form Builder

Patch status unknownEPSS %118 d ago

9.8

CVE-2026-15989Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

VendorWebRehab ProductSuper Forms – Drag & Drop Form Builder

Patch status unknownEPSS %018 d ago

9.1

CVE-2026-17609Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

VendorWebRehab ProductSuper Forms – Drag & Drop Form Builder

Patch status unknownEPSS %011 d ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-15897"