CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
Explanation of Vulnerability in Simple Terms
Contact Form by Supsystic versions up to 1.7.28 contain a vulnerability that allows high-privilege users to read sensitive data, modify site content, or disrupt service across the entire application. The flaw requires administrator-level access to exploit and affects the scope beyond the vulnerable component itself. Site owners should update immediately to a version newer than 1.7.28.
What an attacker can do
Read sensitive data, modify site content, or disrupt service if they have administrator access.
Potential impact on your site
Administrators with malicious intent or compromised admin accounts can access all site data and modify or disable functionality.
Conditions required to exploit
Attacker must have administrator-level privileges on the site.
Key dates
External resources
Related vulnerabilities
