Predictable Value Range from Previous Values

Overview Affected versions of this package are vulnerable to Predictable Value Range from Previous Values via the boundary value, which uses Math.random. An attacker can manipulate HTTP request boundaries by exploiting predictable values, potentially leading to HTTP parameter pollution. Remediati...

CVE-2025-7783

CVE-2025-7783 affects node-form-data; vulnerable versions include

CVE-2025-7783

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. This issue affects form-data: 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3...

10secondsofcode-custom (1.0.0), 1kohei1 (>=1.0.0, <=1.0.1) +4250 more potentially affected by CVE-2025-7783 via form-data (>=4.0.0, <=4.0.3)

form-data NPM version =4.0.0, =1.0.0, =1.2.0, =1.0.0, =0.1.0, =0.0.1, =5.0.0, =0.0.1, =1.0.1, =1.0.32, =1.0.32, =1.1.11 and more Source cves: CVE-2025-7783 Source advisory: MEND:CVE-2025-7783...

CVE-2025-7783 Usage of unsafe random function in form-data for choosing boundary

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. This issue affects form-data: 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3...

CVE-2025-7783

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. This issue affects form-data: 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @5ht/express (>=1.0.6, <=2.2.0) +625 more potentially affected by CVE-2025-7783 via form-data (>=3.0.0, <=3.0.3)

form-data NPM version =3.0.0, =1.17.6-next.0, =1.0.6, =1.0.0, =0.12.4, =1.1.3, =1.9.19, =1.1.0, =1.18.0, =2.13.1, =1.1.0, =10.1.0, =1.0.0, =1.9.2, =2.1.4 and more Source cves: CVE-2025-7783 Source advisory: MEND:CVE-2025-7783...

CVE-2025-7783 Usage of unsafe random function in form-data for choosing boundary

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. This issue affects form-data: 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3...

CVE-2025-7783 Usage of unsafe random function in form-data for choosing boundary

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. This issue affects form-data: 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3...

form-data security vulnerability

Form-Data is a FormData open source module for creating readable form data streams. It can be used for form submissions and file uploads to other web applications. A security vulnerability exists in form-data versions prior to 2.5.4, 3.0.0 through 3.0.3, and 4.0.0 through 4.0.3, which stems from ...

CVE-2025-7783: Use of Insufficiently Random Values

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. This issue affects form-data: 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3...

PT-2025-30061

Name of the Vulnerable Software and Affected Versions form-data versions 2.5.4 form-data versions 3.0.0 through 3.0.3 form-data versions 4.0.0 through 4.0.3 Description A vulnerability exists in the form-data JavaScript library due to the use of insufficiently random values when generating bounda...

CVE-2025-7338: Uncaught Exception

Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service DoS by sending a malformed multi-part upload request. This request causes an unhandled...

Tornado multipart/form-data DoS

The vulnerability of the multipart/form-data component of the web framework and the asynchronous networking library Tornado is related to the use of incorrect authentication tokens due to unlimited resource distribution. Exploiting this vulnerability can allow a malicious actor to cause service...

WordPress Radio Station Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress Radio Station, which stems from the application not properly handling user-submitted form data, and no detail...

CVE-2025-5692

The CVE-2025-5692 entry concerns the WordPress plugin Lead Form Data Collection to CRM (versions up to and including 3.1). It states a missing capability check in multiple functions within LB_admin_ajax.php (notably doFieldAjaxAction), allowing authenticated users with Subscriber-level access and...

CVE-2025-5692: Missing Authorization

The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /includes/LBadminajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with...

PT-2025-27582

Name of the Vulnerable Software and Affected Versions: Lead Form Data Collection to CRM plugin for WordPress versions up to, and including, 3.1 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the doFieldAjaxActi...

WordPress plugin for lead form data collection has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. An elevation of privilege vulnerability exists in the WordPress Lead Form Data Collection to CRM plugin, which stems from a missing capability check in the function...

Security Bulletin: Werkzeug < 3.0.6 - Multipart Form Data Parsing Resource Exhaustion Vulnerability

Summary Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests e.g. all flask applications are vulnerable to a relatively simple but...