CVE-2026-19678EUVD-2026-108562GHSA-QGFH-WGWF-XMCX
Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects onPhase Forms, specifically its unauthenticated form service. An unauthenticated remote attacker can exploit a server-side request forgery flaw to read sensitive data from an internal Apache Solr instance, using a crafted URL submitted through a publicly accessible form.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- onPhase onPhase Forms
11.0.14