CVE-2026-39436
Deferred Deferred - Pending Action
Cross-Site Request Forgery in CformsII

Publication date: 2026-05-25

Last updated on: 2026-05-25

Assigner: Patchstack

Description
Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affects CformsII: from n/a through 15.1.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-25
Last Modified
2026-05-25
Generated
2026-06-15
AI Q&A
2026-05-26
EPSS Evaluated
2026-06-14
NVD
CVE-2026-39436
EUVD
EUVD-2026-31766
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
bgermann cformsii to 15.1.3 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue found in bgermann CformsII. It allows an attacker to trick a user into performing unwanted actions on a web application in which they are authenticated, without their consent.

Impact Analysis

The impact of this vulnerability includes the possibility of an attacker causing unauthorized actions to be executed on behalf of a user. According to the CVSS score, it has a high impact on availability (A:H) and a low impact on integrity (I:L), meaning it can disrupt service or functionality and cause limited data modification.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart