KKC73/me

Releases0

Hello World!

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-55797 ↗	Sep 30, 2025Tuesday, 30 September 2025, 16:15	6.5 MEDIUM	—
An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed.
CVE-2025-56236 ↗	Aug 28, 2025Thursday, 28 August 2025, 15:16	6.1 MEDIUM	—
FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.