CVE Intelligence
Analysis AI-assisted

CVE-2026-32525: JetFormBuilder (jetmonsters) - Code Injection (CWE-94)

According to the record, a code injection flaw (CWE-94) affects the JetFormBuilder product from jetmonsters in versions up to and including 3.5.6.1. The CNA assigned a critical CVSS 3.1 base score of 9.9, and the vector indicates network reachability with low privileges required. No fixed version and no confirmed exploitation appear in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a code injection flaw (CWE-94) in JetFormBuilder from jetmonsters. The stated range runs through 3.5.6.1, and the lower bound is given only as 'n/a'.

Impact

  • The CVSS 3.1 vector supplied by the CNA describes network attack, low attack complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity and availability.
  • Code injection weaknesses can allow code to run in the context of the affected application. The record does not confirm the exact consequences in this product.

Affected products and versions

  • Product: JetFormBuilder, published by jetmonsters.
  • Stated range: up to and including 3.5.6.1. The lower bound is not specified.
  • The affected and fixes lists in the record are empty, so no machine-readable version data is available.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalogue. No confirmed exploitation appears in the sources consulted. The EPSS data in the record gives a probability of 0.00518 and a percentile of 0.4245.

Remediation and mitigation

  • Inventory all JetFormBuilder installations and record their versions.
  • Plan an update to a release later than 3.5.6.1 once the vendor publishes one. The record does not name a fixed version.
  • Until a fix is applied, restrict who can reach the affected functionality, remove unused accounts, and disable the component where it is not needed.
  • Check the Patchstack reference for vendor-specific guidance.

Detection guidance

  • Review web server and application logs for unusual requests to form-processing functionality.
  • Look for unexpected file changes or new script files in plugin directories.
  • Watch for unexpected outbound connections from the web server.

Limitations of the available information

  • The record contains no fixed version, no affected version list and no vendor advisory text.
  • The Patchstack page was not reviewed for this analysis, so vendor details remain unknown.
  • The EPSS date in the record (2026-10-13) is later than the publication date and should be verified against the source.

Frequently asked questions

Which product and versions does CVE-2026-32525 affect?

The record names JetFormBuilder from jetmonsters and states a range up to and including 3.5.6.1. The lower bound is not specified, and no machine-readable affected list is provided.

Is this vulnerability known to be exploited?

The record does not list it in the CISA KEV catalogue, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.