CVE-2025-64515
mediumpriority · track · 0EPSS 0.003 · 20 %ileEUUSEPSS · scored 2026-10-27
Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-64515cnnvd
- https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18cnnvd
- https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18cnnvd
- https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvfcnnvd
- https://github.com/open-formulieren/open-forms/tagsPatchcnnvd
- https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18enisa_euvd
- https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18enisa_euvd
- https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvfenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan