EUVD-2026-96051

The Avada Fusion Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field valu...

EXPLOIT-CVE-2025-55182

CVE-2025-55182 Proof of Concept Overview A practical demonstration of CVE-2025-55182 React2Shell - a critical RCE vulnerability in React Server Components. Vulnerability Details CVE ID : CVE-2025-55182 Type : Remote Code Execution via Prototype Pollution CVSS : 9.8 CRITICAL Affected : React...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of inherited Symbol.toStringTag, append, and getHeaders properties during FormData header resolution, which allows an attacker with a separate prototype-pollution capability to inject attacker-controlled...

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders vulnerability discovered by ? in WordPress Npm axios versions = 1.12.0, 1.20.0...

EUVD-2026-88368

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders...

Linux Distros Unpatched Vulnerability : CVE-2026-101900

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and...

DEBIAN-CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-96758: Improper Control of Generation of Code

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

WordPress Unlimited Elements For Elementor plugin <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter vulnerability

Reflected Cross-Site Scripting via 'formDataid' Parameter vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.17...

CVE-2026-75586

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formDataid' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-75586 Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formDataid' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-75586

Unlimited Elements For Elementor (WordPress plugin) is affected by a Reflected Cross-Site Scripting vulnerability in the formData[id] parameter across all versions up to and including 2.0.17 . The root cause is a front-end AJAX handler registered on the public wp action with no nonce, capability,...

CVE-2026-75586 Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formDataid' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-71931

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formDataid' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-75586: Improper Neutralization of Input During Web Page Generation

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formDataid' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-86362

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formDataid' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

UBUNTU-CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...