CVE-2026-77137 — SQL Injection in extension "Forms Export" (frp_form_answers)
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parame…
Published: 2026-08-25 · CVSS: 7.7 · CVSS 4.0
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7