Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3.
References
Configurations
Configuration 1 (hide)
|
History
02 Dec 2025, 20:39
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:maykinmedia:open_forms:*:*:*:*:*:*:*:* | |
| First Time |
Maykinmedia open Forms
Maykinmedia |
|
| References | () https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18 - Release Notes | |
| References | () https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18 - Release Notes | |
| References | () https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf - Patch, Vendor Advisory |
18 Nov 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-18 23:15
Updated : 2025-12-02 20:39
NVD link : CVE-2025-64515
Mitre link : CVE-2025-64515
CVE.ORG link : CVE-2025-64515
JSON object : View
Products Affected
maykinmedia
- open_forms
CWE