endatix vulnerabilities

CVEs whose affected-version data names the endatix package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-61529Medium· 4.7

1w ago

Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-controlled `JsonData` after checking only that the JSON is well f…

▾ Sunlitendatix · endatixEPSS 0.21%via CVEORG