Missing Input validation in combination with other vulnerabilities allows an attacker to achieve Remote Code Execution (RCE). The application fails to properly sanitize user-supplied input during multiple access points which allows an attacker to conduct arbitrary code execution on the system.

• Product: docuForm FSM Client
• Affected Versions: 11.11c
• Vulnerability Type: CWE-20: Improper Input Validation
• Risk Level: High - CVSS 3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
• Vendor URL: www.docuform.de
• Vendor acknowledged vulnerability: Yes
• Vendor Status: Fixed
• CVE: CVE-2026-51924

Successful exploitation of this vulnerability allows an authenticated remote attacker to execute arbitrary code on the target system. This could lead to a complete compromise of the application, including unauthorized access to sensitive data and modification of system configurations.