CVE-2026-51924
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability in docuForm GmbH Client version 11.11c allows a remote attacker to execute arbitrary code via the file upload mechanism and the report.php component.
Risk Assessment
An attacker could take over the server, steal data, or install malware, posing a critical threat to system confidentiality and integrity.
Recommendation
Immediately update docuForm GmbH Client to the latest version and restrict access to file upload and report.php functions to trusted users only.
Other vulnerabilities in docuForm GmbH Client
See all- CVE-2026-51925High
A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c in the dfm-menu_report.php component. A remote attacker can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files, potentially leading to arbitrary code execution.
- CVE-2026-51923High
An IDOR vulnerability in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the user settings component and modify or retrieve sensitive data from other users' accounts.
Original NVD description (English source)
An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component